19

Is there a way to list all domains on an SAN/UCC SSL Certificate (ideally using command line on linux/os x)?

Clearly there must be some way to extract the data, since browsers can do it. Unfortunately, I can see the list but can't cut and paste it.

31
openssl x509 -text < $CERT_FILE

#=>

. . .
                DNS: . . .
. . .

where $CERT_FILE can have either the .pem or .crt extension.

Shell functions for viewing cert. files and checking that a cert. & key file match can be found here.

2
  • 3
    For posterity, this is the full command I used, since I was doing it for another server: openssl s_client -showcerts -connect www.example.org:443 | openssl x509 -text Sep 10 '12 at 13:39
  • 3
    To get a clean space delimited list of domains you can pass it through grep and sed like so openssl x509 -text < $CRT | grep 'DNS:' | sed 's/\s*DNS:\([a-z0-9.\-]*\)[,\s]\?/\1 /g'
    – Geoffrey
    Apr 28 '17 at 8:49
14

You can list the domains with this command (tested on linux):

cat cert.pem | openssl x509 -text | grep DNS
0
4

If you just want to see the SANs, grep DNS: is the obvious solution.

If you want to have a cleaner list to process further, you can use this Perl regex to extract just the names : @names=/\sDNS:([^\s,]+)/g

For example:

true | openssl s_client -connect example.com:443 2>/dev/null \
| openssl x509 -noout -text \
| perl -l -0777 -ne '@names=/\bDNS:([^\s,]+)/g; print join("\n", sort @names);'

Which would output this:

example.com
example.edu
example.net
example.org
www.example.com
www.example.edu
www.example.net
www.example.org

So you could pipe that to while read name; do echo "processing $name ..."; done etc.

Or for a comma-separated list on one line, replace join("\n", with join(",",

(The -0777 switch for perl makes it read the whole input at once instead of line by line)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.