Last updated on December 27, 2023
With GnuTLS, we can view the certificate details of a website with the following commands (replace “example.com” with the website of your interest):
gnutls-cli --print-cert example.com < /dev/null | certtool --certificate-infoIn the command above, gnutls-cli --print-cert example.com < /dev/null prints the certificate of the website in PEM format to the standard output. Its output is then sent as the standard input to certtool --certificate-info, which prints information on the given certificate.
The output from the command above looks like the follows:
X.509 Certificate Information:
Version: 3
Serial Number (hex): 0c1fcb184518c7e3866741236d6b73f1
Issuer: CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US
Validity:
Not Before: Fri Jan 13 00:00:00 UTC 2023
Not After: Tue Feb 13 23:59:59 UTC 2024
Subject: CN=www.example.org,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US
Subject Public Key Algorithm: RSA
Algorithm Security Level: Medium (2048 bits)
Modulus (bits 2048):
00:c2:80:77:89:59:b8:45:6f:ba:4a:d9:11:fa:7b:ad
c7:57:d0:7a:fb:b6:fa:dd:05:bb:a2:81:71:bb:e1:7f
21:d2:5f:2e:f0:d2:72:4e:75:34:f8:8d:62:e3:4a:da
51:90:d4:01:3d:9c:0c:c0:71:f7:e6:2f:b6:d6:07:67
26:d0:de:ff:17:ce:f0:85:fd:31:c1:66:ca:87:65:05
47:2a:5f:c0:ab:b8:8c:c3:bf:d0:17:7f:63:a3:5c:f0
46:fb:86:aa:fb:4d:d7:2a:5e:7f:9a:e0:13:97:7d:be
fb:7d:35:57:0d:5d:5e:81:98:35:ea:16:42:a2:d3:b0
74:f7:59:2d:ed:38:e7:fe:7a:1b:b3:36:e6:7e:ae:3f
9e:a6:16:83:de:53:01:4e:81:00:ae:bb:42:f5:1f:75
29:34:cd:e9:84:80:38:ae:3c:37:14:c0:f0:27:ce:30
52:b9:8a:dc:5f:22:a0:79:f8:4f:4e:49:04:e2:75:7c
aa:2f:2a:1e:03:ec:71:4c:a3:2a:61:fc:6f:ca:91:1e
93:5a:2e:78:08:58:f6:ee:bb:34:20:5d:9a:e6:af:c6
d7:f2:bf:0a:7b:fa:8e:92:77:e3:6c:7b:0c:40:86:64
4a:15:ec:70:d7:72:8e:63:30:e1:0b:ef:5a:30:97:2e
25
Exponent (bits 24):
01:00:01
Extensions:
Authority Key Identifier (not critical):
b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
Subject Key Identifier (not critical):
b0933fe81782fd6cb2b61787cbe380fe829b019e
Subject Alternative Name (not critical):
DNSname: www.example.org
DNSname: example.net
DNSname: example.edu
DNSname: example.com
DNSname: example.org
DNSname: www.example.com
DNSname: www.example.edu
DNSname: www.example.net
Key Usage (critical):
Digital signature.
Key encipherment.
Key Purpose (not critical):
TLS WWW Server.
TLS WWW Client.
CRL Distribution points (not critical):
URI: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl
URI: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl
Certificate Policies (not critical):
2.23.140.1.2.2 (CA/B Organization Validated)
URI: http://www.digicert.com/CPS
Authority Information Access (not critical):
Access Method: 1.3.6.1.5.5.7.48.1 (id-ad-ocsp)
Access Location URI: http://ocsp.digicert.com
Access Method: 1.3.6.1.5.5.7.48.2 (id-ad-caIssuers)
Access Location URI: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt
Basic Constraints (not critical):
Certificate Authority (CA): FALSE
CT Precertificate SCTs (not critical):
Signed Certificate Timestamp 1:
Version: 1
Log ID: eecdd064d5db1acec55cb79db4cd13a23287467cbcecdec351485946711fb59b
Time: Fri, Jan 13 13:18:21 UTC 2023
Extensions: none
Signature algorithm: ECDSA-SHA256
Signature: 3045022100aadf9f2ba8c574603ab6fd045adf6b6b1d16601578adef6381982ad338b8d90502204061d722a93ef817d41ade134c01526ae2395521252efb2a0175f777d3dbcefb
Signed Certificate Timestamp 2:
Version: 1
Log ID: 73d99e891b4c9678a0207d479de6b2c61cd0515e71192a8c6b80107ac17772b5
Time: Fri, Jan 13 13:18:22 UTC 2023
Extensions: none
Signature algorithm: ECDSA-SHA256
Signature: 3046022100d7649414ae6b80ba91cef81cafb6735789e5f99b7d965a00cd12df3dceef48f0022100973dbc12731d6b13e06315ac199558cb8ffd4fb0cd0a41072c7c70d92544cbc0
Signed Certificate Timestamp 3:
Version: 1
Log ID: 48b0e36bdaa647340fe56a02fa9d30eb1c5201cb56dd2c81d9bbbfab39d88473
Time: Fri, Jan 13 13:18:22 UTC 2023
Extensions: none
Signature algorithm: ECDSA-SHA256
Signature: 3045022100de5b847b61a3258c27709007fd626051213205159058470ccfe7944f53842c2102200fbcf257ca9edada4cf0257dcfedfa87e57928deb3e10b34685d877a5be4240a
Signature Algorithm: RSA-SHA256
Signature:
59:e4:4a:d8:a9:82:ba:9a:4a:f1:63:0c:6d:76:26:75
b3:3c:74:be:c5:f7:3d:a7:91:92:f8:cf:06:2d:58:10
ed:f3:b8:d6:fc:6c:ff:13:96:32:cd:4f:e9:87:24:85
0b:74:a2:c2:f6:0f:f5:a7:d8:7d:76:8a:ae:e9:c9:58
2b:6e:00:6f:b9:cd:24:ee:c4:42:c5:4c:16:85:9d:34
61:39:23:bf:c6:8e:95:c9:84:a9:b2:e5:41:0f:44:78
d7:95:b9:cf:d9:74:bf:58:4f:e7:16:ff:7c:40:30:c4
6c:4e:22:4d:cb:83:67:3a:93:bf:2b:c5:c5:9c:1a:f2
43:a1:25:3b:84:f6:f7:53:6e:a8:85:ae:de:14:74:91
30:06:0d:f2:07:d4:c4:08:ba:43:64:c5:e2:3f:da:ac
c5:41:af:a4:37:e8:42:76:74:f7:13:bb:4a:7d:36:59
81:9b:c7:44:df:89:73:b9:33:42:e8:60:c2:4d:61:5d
12:5a:10:f6:ef:ff:33:89:14:50:e8:d6:9f:c6:b9:5c
2b:35:db:ad:ed:dd:36:b6:25:f2:95:8a:ac:69:3f:9a
fe:1a:f8:15:28:6d:ea:18:5a:c2:d2:62:18:af:40:78
b5:fa:5e:09:8f:53:f9:cc:f8:23:a1:83:31:23:f4:c6
Other Information:
Fingerprint:
sha1:f2aad73d32683b716d2a7d61b51c6d5764ab3899
sha256:5ef2f214260ab8f58e55eea42e4ac04b0f171807d8d1185fddd67470e9ab6096
Public Key ID:
sha1:9a1e8f70cb8292d4600f87cafc2289b3c1d3e350
sha256:5ecfa98d1a76dd09265de1f7d4a1008ccd5a5afc691d3eaf632faada5b6ab5a3
Public Key PIN:
pin-sha256:Xs+pjRp23QkmXeH31KEAjM1aWvxpHT6vYy+q2ltqtaM=
-----BEGIN CERTIFICATE-----
MIIHSjCCBjKgAwIBAgIQDB/LGEUYx+OGZ0EjbWtz8TANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSkwJwYDVQQDEyBE
aWdpQ2VydCBUTFMgUlNBIFNIQTI1NiAyMDIwIENBMTAeFw0yMzAxMTMwMDAwMDBa
Fw0yNDAyMTMyMzU5NTlaMIGWMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZv
cm5pYTEUMBIGA1UEBxMLTG9zIEFuZ2VsZXMxQjBABgNVBAoMOUludGVybmV0wqBD
b3Jwb3JhdGlvbsKgZm9ywqBBc3NpZ25lZMKgTmFtZXPCoGFuZMKgTnVtYmVyczEY
MBYGA1UEAxMPd3d3LmV4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAwoB3iVm4RW+6StkR+nutx1fQevu2+t0Fu6KBcbvhfyHSXy7w0nJO
dTT4jWLjStpRkNQBPZwMwHH35i+21gdnJtDe/xfO8IX9McFmyodlBUcqX8CruIzD
v9AXf2OjXPBG+4aq+03XKl5/muATl32++301Vw1dXoGYNeoWQqLTsHT3WS3tOOf+
ehuzNuZ+rj+ephaD3lMBToEArrtC9R91KTTN6YSAOK48NxTA8CfOMFK5itxfIqB5
+E9OSQTidXyqLyoeA+xxTKMqYfxvypEek1oueAhY9u67NCBdmuavxtfyvwp7+o6S
d+NsewxAhmRKFexw13KOYzDhC+9aMJcuJQIDAQABo4ID2DCCA9QwHwYDVR0jBBgw
FoAUt2ui6qiqhIx56rTaD5iyxZV2ufQwHQYDVR0OBBYEFLCTP+gXgv1ssrYXh8vj
gP6CmwGeMIGBBgNVHREEejB4gg93d3cuZXhhbXBsZS5vcmeCC2V4YW1wbGUubmV0
ggtleGFtcGxlLmVkdYILZXhhbXBsZS5jb22CC2V4YW1wbGUub3Jngg93d3cuZXhh
bXBsZS5jb22CD3d3dy5leGFtcGxlLmVkdYIPd3d3LmV4YW1wbGUubmV0MA4GA1Ud
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwgY8GA1Ud
HwSBhzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0
VExTUlNBU0hBMjU2MjAyMENBMS00LmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGln
aWNlcnQuY29tL0RpZ2lDZXJ0VExTUlNBU0hBMjU2MjAyMENBMS00LmNybDA+BgNV
HSAENzA1MDMGBmeBDAECAjApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2lj
ZXJ0LmNvbS9DUFMwfwYIKwYBBQUHAQEEczBxMCQGCCsGAQUFBzABhhhodHRwOi8v
b2NzcC5kaWdpY2VydC5jb20wSQYIKwYBBQUHMAKGPWh0dHA6Ly9jYWNlcnRzLmRp
Z2ljZXJ0LmNvbS9EaWdpQ2VydFRMU1JTQVNIQTI1NjIwMjBDQTEtMS5jcnQwCQYD
VR0TBAIwADCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHYA7s3QZNXbGs7FXLed
tM0TojKHRny87N7DUUhZRnEftZsAAAGFq0gFIwAABAMARzBFAiEAqt+fK6jFdGA6
tv0EWt9rax0WYBV4re9jgZgq0zi42QUCIEBh1yKpPvgX1BreE0wBUmriOVUhJS77
KgF193fT2877AHcAc9meiRtMlnigIH1HneayxhzQUV5xGSqMa4AQesF3crUAAAGF
q0gFnwAABAMASDBGAiEA12SUFK5rgLqRzvgcr7ZzV4nl+Zt9lloAzRLfPc7vSPAC
IQCXPbwScx1rE+BjFawZlVjLj/1PsM0KQQcsfHDZJUTLwAB2AEiw42vapkc0D+Vq
AvqdMOscUgHLVt0sgdm7v6s52IRzAAABhatIBV4AAAQDAEcwRQIhAN5bhHthoyWM
J3CQB/1iYFEhMgUVkFhHDM/nlE9ThCwhAiAPvPJXyp7a2kzwJX3P7fqH5Xko3rPh
CzRoXYd6W+QkCjANBgkqhkiG9w0BAQsFAAOCAQEAWeRK2KmCuppK8WMMbXYmdbM8
dL7F9z2nkZL4zwYtWBDt87jW/Gz/E5YyzU/phySFC3SiwvYP9afYfXaKrunJWCtu
AG+5zSTuxELFTBaFnTRhOSO/xo6VyYSpsuVBD0R415W5z9l0v1hP5xb/fEAwxGxO
Ik3Lg2c6k78rxcWcGvJDoSU7hPb3U26oha7eFHSRMAYN8gfUxAi6Q2TF4j/arMVB
r6Q36EJ2dPcTu0p9NlmBm8dE34lzuTNC6GDCTWFdEloQ9u//M4kUUOjWn8a5XCs1
263t3Ta2JfKViqxpP5r+GvgVKG3qGFrC0mIYr0B4tfpeCY9T+cz4I6GDMSP0xg==
-----END CERTIFICATE-----
X.509 Certificate Information:
Version: 3
Serial Number (hex): 06d8d904d5584346f68a2fa754227ec4
Issuer: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Validity:
Not Before: Wed Apr 14 00:00:00 UTC 2021
Not After: Sun Apr 13 23:59:59 UTC 2031
Subject: CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US
Subject Public Key Algorithm: RSA
Algorithm Security Level: Medium (2048 bits)
Modulus (bits 2048):
00:c1:4b:b3:65:47:70:bc:dd:4f:58:db:ec:9c:ed:c3
66:e5:1f:31:13:54:ad:4a:66:46:1f:2c:0a:ec:64:07
e5:2e:dc:dc:b9:0a:20:ed:df:e3:c4:d0:9e:9a:a9:7a
1d:82:88:e5:11:56:db:1e:9f:58:c2:51:e7:2c:34:0d
2e:d2:92:e1:56:cb:f1:79:5f:b3:bb:87:ca:25:03:7b
9a:52:41:66:10:60:4f:57:13:49:f0:e8:37:67:83:df
e7:d3:4b:67:4c:22:51:a6:df:0e:99:10:ed:57:51:74
26:e2:7d:c7:ca:62:2e:13:1b:7f:23:88:25:53:6f:c1
34:58:00:8b:84:ff:f8:be:a7:58:49:22:7b:96:ad:a2
88:9b:15:bc:a0:7c:df:e9:51:a8:d5:b0:ed:37:e2:36
b4:82:4b:62:b5:49:9a:ec:c7:67:d6:e3:3e:f5:e3:d6
12:5e:44:f1:bf:71:42:7d:58:84:03:80:b1:81:01:fa
f9:ca:32:bb:b4:8e:27:87:27:c5:2b:74:d4:a8:d6:97
de:c3:64:f9:ca:ce:53:a2:56:bc:78:17:8e:49:03:29
ae:fb:49:4f:a4:15:b9:ce:f2:5c:19:57:6d:6b:79:a7
2b:a2:27:20:13:b5:d0:3d:40:d3:21:30:07:93:ea:99
f5
Exponent (bits 24):
01:00:01
Extensions:
Basic Constraints (critical):
Certificate Authority (CA): TRUE
Path Length Constraint: 0
Subject Key Identifier (not critical):
b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
Authority Key Identifier (not critical):
03de503556d14cbb66f0a3e21b1bc397b23dd155
Key Usage (critical):
Digital signature.
Certificate signing.
CRL signing.
Key Purpose (not critical):
TLS WWW Server.
TLS WWW Client.
Authority Information Access (not critical):
Access Method: 1.3.6.1.5.5.7.48.1 (id-ad-ocsp)
Access Location URI: http://ocsp.digicert.com
Access Method: 1.3.6.1.5.5.7.48.2 (id-ad-caIssuers)
Access Location URI: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt
CRL Distribution points (not critical):
URI: http://crl3.digicert.com/DigiCertGlobalRootCA.crl
Certificate Policies (not critical):
2.16.840.1.114412.2.1
2.23.140.1.1 (CA/B Extended Validation)
2.23.140.1.2.1 (CA/B Domain Validated)
2.23.140.1.2.2 (CA/B Organization Validated)
2.23.140.1.2.3 (CA/B Individual Validated)
Signature Algorithm: RSA-SHA256
Signature:
80:32:ce:5e:0b:dd:6e:5a:0d:0a:af:e1:d6:84:cb:c0
8e:fa:85:70:ed:da:5d:b3:0c:f7:2b:75:40:fe:85:0a
fa:f3:31:78:b7:70:4b:1a:89:58:ba:80:bd:f3:6b:1d
e9:7e:cf:0b:ba:58:9c:59:d4:90:d3:fd:6c:fd:d0:98
6d:b7:71:82:5b:cf:6d:0b:5a:09:d0:7b:de:c4:43:d8
2a:a4:de:9e:41:26:5f:bb:8f:99:cb:dd:ae:e1:a8:6f
9f:87:fe:74:b7:1f:1b:20:ab:b1:4f:c6:f5:67:5d:5d
9b:3c:e9:ff:69:f7:61:6c:d6:d9:f3:fd:36:c6:ab:03
88:76:d2:4b:2e:75:86:e3:fc:d8:55:7d:26:c2:11:77
df:3e:02:b6:7c:f3:ab:7b:7a:86:36:6f:b8:f7:d8:93
71:cf:86:df:73:30:fa:7b:ab:ed:2a:59:c8:42:84:3b
11:17:1a:52:f3:c9:0e:14:7d:a2:5b:72:67:ba:71:ed
57:47:66:c5:b8:02:4a:65:34:5e:8b:d0:2a:3c:20:9c
51:99:4c:e7:52:9e:f7:6b:11:2b:0d:92:7e:1d:e8:8a
eb:36:16:43:87:ea:2a:63:bf:75:3f:eb:de:c4:03:bb
0a:3c:f7:30:ef:eb:af:4c:fc:8b:36:10:73:3e:f3:a4
Other Information:
Fingerprint:
sha1:1c58a3a8518e8759bf075b76b750d4f2df264fcd
sha256:52274c57ce4dee3b49db7a7ff708c040f771898b3be88725a86fb4430182fe14
Public Key ID:
sha1:c2596d620a6852b636380f3567de3ec794d1c532
sha256:450799901e36ce751fb0320815621189811c2a5ee71f0345c160ab9cc3096d57
Public Key PIN:
pin-sha256:RQeZkB42znUfsDIIFWIRiYEcKl7nHwNFwWCrnMMJbVc=
-----BEGIN CERTIFICATE-----
MIIEvjCCA6agAwIBAgIQBtjZBNVYQ0b2ii+nVCJ+xDANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0yMTA0MTQwMDAwMDBaFw0zMTA0MTMyMzU5NTlaME8xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxKTAnBgNVBAMTIERpZ2lDZXJ0IFRMUyBS
U0EgU0hBMjU2IDIwMjAgQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAwUuzZUdwvN1PWNvsnO3DZuUfMRNUrUpmRh8sCuxkB+Uu3Ny5CiDt3+PE0J6a
qXodgojlEVbbHp9YwlHnLDQNLtKS4VbL8Xlfs7uHyiUDe5pSQWYQYE9XE0nw6Ddn
g9/n00tnTCJRpt8OmRDtV1F0JuJ9x8piLhMbfyOIJVNvwTRYAIuE//i+p1hJInuW
raKImxW8oHzf6VGo1bDtN+I2tIJLYrVJmuzHZ9bjPvXj1hJeRPG/cUJ9WIQDgLGB
Afr5yjK7tI4nhyfFK3TUqNaX3sNk+crOU6JWvHgXjkkDKa77SU+kFbnO8lwZV21r
eacroicgE7XQPUDTITAHk+qZ9QIDAQABo4IBgjCCAX4wEgYDVR0TAQH/BAgwBgEB
/wIBADAdBgNVHQ4EFgQUt2ui6qiqhIx56rTaD5iyxZV2ufQwHwYDVR0jBBgwFoAU
A95QNVbRTLtm8KPiGxvDl7I90VUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQG
CCsGAQUFBwMBBggrBgEFBQcDAjB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGG
GGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBABggrBgEFBQcwAoY0aHR0cDovL2Nh
Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNydDBCBgNV
HR8EOzA5MDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRH
bG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwCwYJYIZIAYb9bAIBMAcGBWeBDAEB
MAgGBmeBDAECATAIBgZngQwBAgIwCAYGZ4EMAQIDMA0GCSqGSIb3DQEBCwUAA4IB
AQCAMs5eC91uWg0Kr+HWhMvAjvqFcO3aXbMM9yt1QP6FCvrzMXi3cEsaiVi6gL3z
ax3pfs8LulicWdSQ0/1s/dCYbbdxglvPbQtaCdB73sRD2Cqk3p5BJl+7j5nL3a7h
qG+fh/50tx8bIKuxT8b1Z11dmzzp/2n3YWzW2fP9NsarA4h20ksudYbj/NhVfSbC
EXffPgK2fPOre3qGNm+499iTcc+G33Mw+nur7SpZyEKEOxEXGlLzyQ4UfaJbcme6
ce1XR2bFuAJKZTRei9AqPCCcUZlM51Ke92sRKw2Sfh3oius2FkOH6ipjv3U/697E
A7sKPPcw7+uvTPyLNhBzPvOk
-----END CERTIFICATE-----
