Home / server / Questions / 425427
Accepted
Jordan Reiter
Asked: 2012-09-08 11:44:16 +0800 CST

Listing domains on a UCC/SAN SSL Certificate

  • 772

Is there a way to list all domains on an SAN/UCC SSL Certificate (ideally using command line on linux/os x)?

Clearly there must be some way to extract the data, since browsers can do it. Unfortunately, I can see the list but can't cut and paste it.

ssl-certificate

5 Answers

  1. Best Answer
    openssl x509 -text < $CERT_FILE

#=>

. . .
                DNS: . . .
. . .

    where $CERT_FILE can have either the .pem or .crt extension.

    Shell functions for viewing cert. files and checking that a cert. & key file match can be found here.

    • 32

  2. You can list the domains with this command (tested on linux):

    cat cert.pem | openssl x509 -text | grep DNS
    • 17

  3. If you just want to see the SANs, grep DNS: is the obvious solution.

    If you want to have a cleaner list to process further, you can use this Perl regex to extract just the names : @names=/\sDNS:([^\s,]+)/g

    For example:

    true | openssl s_client -connect example.com:443 2>/dev/null \
| openssl x509 -noout -text \
| perl -l -0777 -ne '@names=/\bDNS:([^\s,]+)/g; print join("\n", sort @names);'

    Which would output this:

    example.com
example.edu
example.net
example.org
www.example.com
www.example.edu
www.example.net
www.example.org

    So you could pipe that to while read name; do echo "processing $name ..."; done etc.

    Or for a comma-separated list on one line, replace join("\n", with join(",",

    (The -0777 switch for perl makes it read the whole input at once instead of line by line)

    • 5

  4. if you'd like to limit dependencies to openssl, grep, sed and tr and still have easily parseable/iterable output:

    • space separated list: 
      $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' ' | tr , ' '
      output: 
      example.com example.org www.example.com www.example.org
    • newline separated list: 
      $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' ' | tr , \\n
      output: 
      example.com
example.org
www.example.com
www.example.org
    • comma separated list: 
      $ openssl x509 -text -in cert.pem | grep DNS | sed s/DNS://g | tr -d ' '
      output: 
      example.com,example.org,www.example.com,www.example.org

    what's going on here?

    • openssl x509 -text -in cert.pem produces human readable cert information
    • grep DNS extracts lines containing the string: DNS
    • sed s/DNS://g removes all occurrences of: DNS:
    • tr -d ' ' removes all space characters
    • tr , ' ' replaces all coma characters with a space character
    • tr , \\n replaces all coma characters with a newline character
    • | the pipe operator passes standard output from the command preceding the pipe to standard input of the command following it
    • 0

  5. This will show all Alternative domains in certificate (needed by all browsers today)

    openssl x509 -text -noout < fullchain.pem | grep DNS

    The answer will be like this

    DNS:*.example.ru, DNS:example.ru
    • 0