16

Is there a way to list all domains on an SAN/UCC SSL Certificate (ideally using command line on linux/os x)?

Clearly there must be some way to extract the data, since browsers can do it. Unfortunately, I can see the list but can't cut and paste it.

26

openssl x509 -text < foo.crt should do the trick.

| improve this answer | |
  • 3
    For posterity, this is the full command I used, since I was doing it for another server: openssl s_client -showcerts -connect www.example.org:443 | openssl x509 -text – Jordan Reiter Sep 10 '12 at 13:39
  • 3
    To get a clean space delimited list of domains you can pass it through grep and sed like so openssl x509 -text < $CRT | grep 'DNS:' | sed 's/\s*DNS:\([a-z0-9.\-]*\)[,\s]\?/\1 /g' – Geoffrey Apr 28 '17 at 8:49
10

You can list the domains with this command (tested on linux):

cat cert.pem | openssl x509 -text | grep DNS
| improve this answer | |
3

If you just want to see the SANs, grep DNS: is the obvious solution.

If you want to have a cleaner list to process further, you can use this Perl regex to extract just the names : @names=/\sDNS:([^\s,]+)/g

For example:

true | openssl s_client -connect example.com:443 2>/dev/null \
| openssl x509 -noout -text \
| perl -l -0777 -ne '@names=/\bDNS:([^\s,]+)/g; print join("\n", sort @names);'

Which would output this:

example.com
example.edu
example.net
example.org
www.example.com
www.example.edu
www.example.net
www.example.org

So you could pipe that to while read name; do echo "processing $name ..."; done etc.

Or for a comma-separated list on one line, replace join("\n", with join(",",

(The -0777 switch for perl makes it read the whole input at once instead of line by line)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.