Listing domains on a UCC/SAN SSL Certificate

Question

Is there a way to list all domains on an SAN/UCC SSL Certificate (ideally using command line on linux/os x)?

Clearly there must be some way to extract the data, since browsers can do it. Unfortunately, I can see the list but can't cut and paste it.

Answer 1

openssl x509 -text < $CERT_FILE

#=>

. . .
                DNS: . . .
. . .

where $CERT_FILE can have either the .pem or .crt extension.

Shell functions for viewing cert. files and checking that a cert. & key file match can be found here.

Answer 2

You can list the domains with this command (tested on linux):

cat cert.pem | openssl x509 -text | grep DNS

Answer 3

If you just want to see the SANs, grep DNS: is the obvious solution.

If you want to have a cleaner list to process further, you can use this Perl regex to extract just the names : @names=/\sDNS:([^\s,]+)/g

For example:

true | openssl s_client -connect example.com:443 2>/dev/null \
| openssl x509 -noout -text \
| perl -l -0777 -ne '@names=/\bDNS:([^\s,]+)/g; print join("\n", sort @names);'

Which would output this:

example.com
example.edu
example.net
example.org
www.example.com
www.example.edu
www.example.net
www.example.org

So you could pipe that to while read name; do echo "processing $name ..."; done etc.

Or for a comma-separated list on one line, replace join("\n", with join(",",

(The -0777 switch for perl makes it read the whole input at once instead of line by line)

Answer 4

if you'd like to limit dependencies to openssl, grep, sed and tr and still have easily parseable/iterable output:

• space separated list:

  $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' ' | tr , ' '
  

  output:

  example.com example.org www.example.com www.example.org
  

• newline separated list:

  $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' ' | tr , \\n
  

  output:

  example.com
  example.org
  www.example.com
  www.example.org
  

• comma separated list:

  $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' '
  

  output:

  example.com,example.org,www.example.com,www.example.org
  

what's going on here?

• openssl x509 -text -in cert.pem produces human readable cert information
• grep DNS extracts lines containing the string: DNS
• sed s/DNS://g removes all occurrences of: DNS:
• tr -d ' ' removes all space characters
• tr , ' ' replaces all coma characters with a space character
• tr , \\n replaces all coma characters with a newline character
• | the pipe operator passes standard output from the command preceding the pipe to standard input of the command following it

Answer 5

This will show all Alternative domains in certificate (needed by all browsers today)

openssl x509 -text -noout < fullchain.pem | grep DNS

The answer will be like this

DNS:*.example.ru, DNS:example.ru