247

I am using Windows and have been given a .cer file. How can I view the details of it?

1

7 Answers 7

393

OpenSSL will allow you to look at it if it is installed on your system, using the OpenSSL x509 tool.

openssl x509 -noout -text -in 'cerfile.cer';

The format of the .CER file might require that you specify a different encoding format to be explicitly called out.

openssl x509 -inform pem -noout -text -in 'cerfile.cer';

or

openssl x509 -inform der -noout -text -in 'cerfile.cer';

On Windows systems you can right click the .cer file and select Open. That will then let you view most of the meta data.

On Windows you run Windows certificate manager program using certmgr.msc command in the run window. Then you can import your certificates and view details.

6
  • 19
    I get "4726:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:632:Expecting: TRUSTED CERTIFICATE" when I do this in Linux
    – yazz.com
    Dec 23, 2010 at 9:51
  • 1
    I've added some clarifications on some OpenSSL options to specify different encoding formats - given your error specifying DER format looks like it would work.
    – Helvick
    Dec 23, 2010 at 10:31
  • 4
    Thanks, "openssl x509 -inform der -in cerfile.cer -noout -text" worked!
    – yazz.com
    Dec 23, 2010 at 12:25
  • 2
    Linux gui version: gcr-viewer. Aug 14, 2014 at 4:11
  • 11
    when getting :0906D06C:PEM routines:PEM_read_bio" error, u will need to use the 3rd command given, with -inform der
    – user289547
    May 18, 2015 at 10:39
46

If you're using Windows, you can use console util

certutil -dump <file>
2
13

All answers here fail for MacOS. The only thing that works in Sierra and High Sierra is:

openssl x509 -inform der -in cerfile.cer -noout -text
5
  • 20
    Helvick's answer (last updated in 2014) contains this exact line.
    – mwfearnley
    May 18, 2018 at 16:18
  • 6
    Surely the necessary solution depends on the format of the certificate file, rather than the system it's used on?
    – mwfearnley
    Aug 20, 2019 at 9:44
  • 2
    I am on Mac OS Mojave. "$ openssl x509 -in host.crt.pem -noout -text" works fine without "inform der".
    – user674669
    Oct 28, 2019 at 22:16
  • @user674669 The pem format is base64, which can be viewed with any text editor.
    – DawnSong
    Jul 10, 2020 at 7:00
  • This worked for me on Ubuntu xenial and OpenSSL 1.1.0h. The other answers did not
    – code_monk
    Oct 5, 2020 at 22:27
5

You can import and preview it by Powershell:

Get-ChildItem –Path c:\file.cer | Import-Certificate –CertStoreLocation cert:\LocalMachine\My

then view it in Windows certmgr.msc or load directly to Powershell

SET-LOCATION CERT:\LOCALMACHINE\my
GET-CHILDITEM –RECURSE | FORMAT-LIST –PROPERTY *

or by Thumbprint

$cert = (Get-ChildItem –Path cert:\LocalMachine\My\AE53B1272E43C14545A448FB892F7C07A217A761)

Don't forget to IMPORT-MODULE PKI

Or you can also view, export, import, and delete certificates by using Internet Explorer.

To view certificates with Internet Explorer

  1. In Internet Explorer, click Tools, then click Internet Options to display the Internet Options dialog box.
  2. Click the Content tab.

  3. Under Certificates, click Certificates. To view details of any certificate, select the certificate and click View.

2
  • 1
    Import-Certificate is not available for me (Win 7/PS 5)
    – jpaugh
    Oct 28, 2019 at 22:31
  • Importing a cert is not a great idea if you only want to inspect it, perhaps to decide if it can be trusted or not.
    – levidos
    Feb 28 at 13:25
5

I found openssl quite limiting (cannot parse content of chain/bundle, output is quite noisy for my needs, ...), I have created certinfo project on github, which can parse chain/bundle, accepts multiple files as argument and can get cert info from host as well if the argument is in the form of host:port.

0
5

I know this is an old question, but I saw no one provided a workable solution for windows 7 using only PowerShell. That didn't require the extra hassle of importing it into the certificate store,other tom foolery like using IE or certutil. I happened to have the same issue today, and this is the solution I came up with:

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate

$cert.Import("D:\mycert.cer")

$cert.GetEffectiveDateString() 
$cert.GetSerialNumber() 
$cert | get-member 
etc..

One thing the x509CErtificate class does not contain is the ability to read CRLs. In order to do that you have to use something like Mono since it has a class that will read them

3

For completeness, if you have Sun/Oracle/OpenJDK Java (or get and install it) you can use

keytool -printcert -v -file {filename}
# works for either PEM or DER, you don't need to specify
# but _very_ old Java (before 7 IIRC) doesn't handle PEM _with comments added_

Back in the days of NT and XP, Java was fashionable and widely promoted, and once MS gave up on their own version of JVM, Sun Java was often -- but not always -- preinstalled on Windows systems, while OpenSSL usually wasn't, so for a while this could have been a good solution. In 2010, when this Q was asked, it was still moderately common, but the numerous security vulnerabilities found in Sun's promoted "download and run everywhere" approach had begun to discourage people.

Now in 2023 I'd bet very few individual Windows users install Java on their own bat, although some enterprises (and I think some government agencies) still have Java applications in their workflows and require or at least encourage users (such as customers, or maybe citizens) to install it. Also a fair number of useful tools are coded in and thus require Java -- two I am personally familiar with are Eclipse (IDE) and Burp (HTTP/S interceptor/proxy). But if you don't already have Java, downloading 50-300MB only to get keytool to look at a cert (or certs) would be ... unwise.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .