General Procedure: How to Check, Validate, and Convert SSL Certificate Using OpenSSL and Keytool Commands (2024)

How to show the contents of a certificate:

Command to show certificate content in OpenSSL:

$ openssl x509 -in <cert_file_name> -noout -text

Sample output:

$ openssl x509 -in sin1091.cer -noout -textCertificate: Data: Version: 3 (0x2) Serial Number: dd:a5:5c:60:f9:b7:16:9e Signature Algorithm: sha256WithRSAEncryption Issuer: CN=CA, DC=vsphere, DC=local, C=US, ST=California, O=sin1090, OU=VMware Validity Not Before: May 24 10:29:00 2017 GMT Not After : Feb 19 12:22:39 2027 GMT Subject: CN=sin1091.eu.degussanet.com, C=US Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c3:24:d9:23:08:32:ca:0e:f9:60:58:f0:8b:04: 6e:db:73:b1:83:a1:73:44:09:30:d7:64:6e:2f:26: e5:87:fd:b9:f3:e6:10:78:32:f5:7c:8b:7f:c1:06: d5:d1:42:d3:d8:e0:d0:84:91:c8:1c:4e:7e:2b:af: 65:36:5e:87:b0:43:4c:fa:ae:ca:c3:23:2d:75:15: 6a:d5:5f:66:6b:40:f6:c5:48:7a:8d:e5:f1:dd:4e: aa:eb:89:65:8a:7e:69:eb:35:4f:75:56:88:24:48: c7:9b:19:fb:39:43:ee:8a:bb:f5:1a:9b:b5:a3:47: b1:60:ee:9a:72:f6:7b:d0:1f:ed:73:64:5f:e9:60: 75:64:03:25:a3:41:38:6d:06:22:dc:22:70:ae:9d: b5:f8:26:7a:8e:d6:05:b1:97:67:89:ac:2c:b3:83: 8b:31:33:a8:7e:30:58:2c:10:42:ef:b6:05:98:ca: 6c:01:c9:47:9e:01:6e:be:c6:bc:cd:9f:e8:bc:8f: 94:70:f1:21:af:ae:b4:fd:76:db:a7:88:fc:e5:d7: ea:08:eb:58:b9:41:37:af:7b:ec:f8:a1:b0:09:a7: b9:b7:18:5b:a7:8e:b9:2f:b0:71:2a:3d:46:8b:c6: 4a:23:43:d9:21:94:2e:0e:e9:40:07:61:22:2e:b4: 08:27 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Alternative Name: DNS:sin1091.eu.degussanet.com X509v3 Subject Key Identifier: D7:4D:DB:D4:00:3A:45:A8:4E:5E:9A:60:DB:C0:94:EA:C0:94:75:DC X509v3 Authority Key Identifier: keyid:5F:81:58:14:37:20:61:1D:BC:47:F2:97:AF:39:45:F0:A5:A9:19:F4 Signature Algorithm: sha256WithRSAEncryption 99:9c:b1:e5:b2:9d:b1:ef:65:8f:3b:de:87:16:01:6e:bb:a2: 37:cc:13:28:a2:a1:0b:88:04:c8:85:d0:34:19:d0:3d:41:e4: d3:6f:54:6f:ce:0d:25:a5:f1:c4:8e:cd:e3:e4:ca:92:1f:67: 3a:bd:27:21:59:37:67:a6:71:53:a4:ab:e5:d4:2c:a4:8f:a4: f3:c9:de:6f:5f:f5:80:38:3f:9e:87:24:c7:dc:9e:d3:45:93: a1:4e:31:db:20:df:84:86:06:c8:39:21:9d:04:57:1f:a2:17: 9b:e4:c7:77:61:73:9b:fe:b2:ac:66:ad:14:50:3a:82:65:10: 3d:bc:15:0b:08:60:79:c1:d1:55:28:25:a4:9b:95:ae:c3:52: 31:66:e9:a3:08:57:4c:ff:5a:ac:5e:09:6c:89:5b:cc:43:ad: 0a:e5:dd:b7:8a:6a:be:e7:52:e9:cf:c9:4a:38:77:05:4c:00: ca:22:2e:e8:8d:a2:37:da:38:bc:5e:ce:2d:aa:5d:44:c8:58: cb:7e:a4:be:fb:0b:b3:b4:88:66:ed:8b:ac:41:b8:8d:8b:48: e5:1a:8e:45:ba:be:42:a3:39:07:85:f5:09:91:c3:38:d5:bf: 73:3d:ba:6c:5c:cf:bc:4b:f9:3e:7b:9c:a6:bb:2b:10:c4:87: 76:35:f1:0d

Command to show certificatesor key pairsthat are stored in a keystore using keytool. PrivateKeyEntry means that it stores both private key and certificate chain entries. TrustedCertEntry means that it only stores trusted certificate and certificate chain entries:

$ keytool -list -v -in <keystore_file_name>

Sample output
* * * * * * * * *
* * * * * * * * *

Alias name: vcenter_caCreation date: Mar 31, 2023Entry type: trustedCertEntryOwner: CN=vc.x400.sh, OU=Dell EMC, O=Dell EMC, L=Shanghai, ST=Shanghai, C=CNIssuer: CN=vc.x400.sh, OU=Dell EMC, O=Dell EMC, L=Shanghai, ST=Shanghai, C=CNSerial number: 840f560790ff8a93Valid from: Fri Mar 31 18:51:25 CST 2023 until: Sat Mar 30 18:51:25 CST 2024Certificate fingerprints: SHA1: 69:F4:39:70:C8:A4:EC:64:C1:46:04:81:44:A1:30:3C:A9:71:12:D0 SHA256: 6C:D7:62:58:BE:AC:A3:D7:25:84:1F:65:93:23:4C:35:5F:25:B6:D2:A0:67:A1:FD:8C:A9:62:3A:D9:0E:24:D3Signature algorithm name: SHA256withRSASubject Public Key Algorithm: 3072-bit RSA keyVersion: 3

* * * * * * * * *
* * * * * * * * *

How to show certificate finger print or thumb print:

Command to show a certificate fingerprint in OpenSSLby default is sha1 fingerprint in OpenSSL. Ensure you are using the same hash algorism when comparing to another certificate:

$ openssl x509 -in <certificate file> -noout -fingerprint [-sha1 or -sha256 or -sha512]

How to convert certificate and private key between different formats:

(Learn about different SSL certificate formats at TutorialsTeacher )

Convert certificate format from DER toPEM:

$ openssl x509 -in <certificate file in DER format> -inform DER -out <certificate file in PEM format>

Convert certificate format from PKCS7to PEM

$ openssl pkcs7 -print_certs -in <certificate file in PKCS7 format>-inform DER -out <certificate file in PEM format>

Convert certificate and private key format from PKCS12 to PEM.

(The first command is to extract certificate file in a PEM format, the second command is to extract private key file in a PEM format.)

$ openssl pkcs12 -in <certificate file in PKCS12 format> -name <alias name> -nokeys -out <certificate file in PEM format>$ openssl pkcs12 -in <certificate file in PKCS12 format> -name <alias name> -nodes -nocerts -out <private key file in PEM format>

Convert certificate or private key pair files from PEM toPKCS12 keystore

(In this example, PEM certificate file is server.crt, private key file is server.key, keystore alias is set to "mykeypair," and pkcs12 keystore file is mykeystore.p12)

$ openssl pkcs12 -export -in <certificate file in PEM format> -inkey <private key file in PEM format> -name <alias name> -out <keystore file in PKCS12 format>

How to validate acertificate in HTTPS handshake using OpenSSL

Use one of the following commands to validate certificate:

$ openssl s_client -CApath <path_to_certs> -connect <VC_FQDN>:443 -showcertsOr$ openssl s_client -CApath <path_to_certs> -host <VC_FQDN> -port:443 -showcerts

Sample output of success (This command may take a while to finish running):

$ openssl s_client -CApath /tmp/certs/ -connect 10.10.10.100:443 -showcertsCONNECTED(00000104)---Certificate chain0 s:/CN=vc18.externalvc.com/C=US i:/CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=psc18.externalvc.com/OU=VMware-----BEGIN CERTIFICATE-----MIIDoDCCAoigAwIBAgIJAM/DCNs2KXy+MA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExHTAbBgNVBAoMFHBzYzE4LmV4dGVybmFsdmMuY29tMQ8wDQYDVQQLDAZWTXdhcmUwHhcNMTcwNjMwMDUzOTE4WhcNMjcwNjI1MDUzNDI0WjArMRwwGgYDVQQDDBN2YzE4LmV4dGVybmFsdmMuY29tMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL1X4Skcl6kjCw3I2vJqvOTFwdQXL87/EqQkuhKfOy87+lo78jdobtAjCqtSV8bszbiJAEftZEWkX6OF45tM1fBmMvuDUMw4rFqV6q0vuBd1LE94SQQIrkb6ze/U+EyDX2eIPWGL63f4XoGLfrx/hxHxGDhLpZBMUiUi7ccIlduNHRjJaW7HDorIg/ABHX2xhU4Sf+E5KWO5INByvtiyVabiUGeDt+9foX78aSvvmsqonW+Bq3yJi65Rm2FOxsXNSLMbtdQ/aS6vCl5LYu7Snku6vAfloDNX5grUhU/iHdxXHkAFAXLIzQPtFK92P8zBLykDwP+cLzud/KO9CfqskPUCAwEAAaNiMGAwHgYDVR0RBBcwFYITdmMxOC5leHRlcm5hbHZjLmNvbTAdBgNVHQ4EFgQUpXe8h597EnWIks76bOf9y+51/lYwHwYDVR0jBBgwFoAU3tDxXouzxNX7qfWfrBTRHdo+Pu8wDQYJKoZIhvcNAQELBQADggEBAHvy40eQ2I8eUFFvEOng2MFAbJH3ZZs2I3w0XuyAMosO4Sw0JYo0hhDLBBZ1Fw7IyRj6jtbvI3UlPLq6NofJUaweo5aphlSPxmbZSl/DcteS4pusujv4lT/h9J95dc0KrFR7abX9rsv0nQQ78wrzE5CUva6TkXOQKg8oxaachYPwKi0zR1vFR56jTt9fHq9Z1lXYkg4JzSu+H4diOs/KNKZYiU+QsD+94I2GjopajYWVSTBkiGAOObG2/inbL2UJW2rK3PASm2M8+x92V0hqlkxBYcvQpjEjuJep2+Ah6iuQIgW21OForIPxqbcuPD5PwMn6eV4mVP7/mWdAfkGtY8I=-----END CERTIFICATE--------Server certificatesubject=/CN=vc18.externalvc.com/C=USissuer=/CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=psc18.externalvc.com/OU=VMware---No client certificate CA names sentPeer signing digest: SHA512Server Temp Key: ECDH, P-256, 256 bits---SSL handshake has read 1412 bytes and written 434 bytes---New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384Server public key is 2048 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: Session-ID-ctx: Master-Key: 70FD868AA56807820DDAC23C2FAB3F2C1A5C683426F2924AEE8D9B52EBCD3F256EC4892D281F90F0F32A2A1C7DD0FB01 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1500280372 Timeout : 300 (sec) Verify return code: 0 (ok)---depth=1 CN = CA, DC = vsphere, DC = local, C = US, ST = California, O = psc18.externalvc.com, OU = VMwareverify return:1depth=0 CN = vc18.externalvc.com, C = USverify return:1read:errno=0

Sample output of failure:

$ openssl s_client -CApath /tmp/certs/ -host 10.62.91.64 -port 443 -showcertsCONNECTED(00000124)---Certificate chain0 s:/CN=vc18.externalvc.com/C=US i:/CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=psc18.externalvc.com/OU=VMware-----BEGIN CERTIFICATE-----MIIDoDCCAoigAwIBAgIJAM/DCNs2KXy+MA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExHTAbBgNVBAoMFHBzYzE4LmV4dGVybmFsdmMuY29tMQ8wDQYDVQQLDAZWTXdhcmUwHhcNMTcwNjMwMDUzOTE4WhcNMjcwNjI1MDUzNDI0WjArMRwwGgYDVQQDDBN2YzE4LmV4dGVybmFsdmMuY29tMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL1X4Skcl6kjCw3I2vJqvOTFwdQXL87/EqQkuhKfOy87+lo78jdobtAjCqtSV8bszbiJAEftZEWkX6OF45tM1fBmMvuDUMw4rFqV6q0vuBd1LE94SQQIrkb6ze/U+EyDX2eIPWGL63f4XoGLfrx/hxHxGDhLpZBMUiUi7ccIlduNHRjJaW7HDorIg/ABHX2xhU4Sf+E5KWO5INByvtiyVabiUGeDt+9foX78aSvvmsqonW+Bq3yJi65Rm2FOxsXNSLMbtdQ/aS6vCl5LYu7Snku6vAfloDNX5grUhU/iHdxXHkAFAXLIzQPtFK92P8zBLykDwP+cLzud/KO9CfqskPUCAwEAAaNiMGAwHgYDVR0RBBcwFYITdmMxOC5leHRlcm5hbHZjLmNvbTAdBgNVHQ4EFgQUpXe8h597EnWIks76bOf9y+51/lYwHwYDVR0jBBgwFoAU3tDxXouzxNX7qfWfrBTRHdo+Pu8wDQYJKoZIhvcNAQELBQADggEBAHvy40eQ2I8eUFFvEOng2MFAbJH3ZZs2I3w0XuyAMosO4Sw0JYo0hhDLBBZ1Fw7IyRj6jtbvI3UlPLq6NofJUaweo5aphlSPxmbZSl/DcteS4pusujv4lT/h9J95dc0KrFR7abX9rsv0nQQ78wrzE5CUva6TkXOQKg8oxaachYPwKi0zR1vFR56jTt9fHq9Z1lXYkg4JzSu+H4diOs/KNKZYiU+QsD+94I2GjopajYWVSTBkiGAOObG2/inbL2UJW2rK3PASm2M8+x92V0hqlkxBYcvQpjEjuJep2+Ah6iuQIgW21OForIPxqbcuPD5PwMn6eV4mVP7/mWdAfkGtY8I=-----END CERTIFICATE--------Server certificatesubject=/CN=vc18.externalvc.com/C=USissuer=/CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=psc18.externalvc.com/OU=VMware---No client certificate CA names sentPeer signing digest: SHA512Server Temp Key: ECDH, P-256, 256 bits---SSL handshake has read 1412 bytes and written 434 bytes---New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384Server public key is 2048 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: Session-ID-ctx: Master-Key: 85731E71188EF310D68C658099C62C11374845CAF00A0AF90F8B35118171C7D0002A76380AB2B4574C720DB178FA3297 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1500281143 Timeout : 300 (sec) Verify return code: 21 (unable to verify the first certificate)---depth=0 CN = vc18.externalvc.com, C = USverify error:num=20:unable to get local issuer certificateverify return:1depth=0 CN = vc18.externalvc.com, C = USverify error:num=21:unable to verify the first certificateverify return:1read:errno=0

How to validate vCenter certificate offline

If you are unable to connect to vCenter and verify online, we can export the vCenter certificate from the web browser, and save to a file for validation.

Convert the file from DER to PEM format.
Use the following command to validate:

$openssl verify -CApath <path_to_certs> <certificate_file>

NOTE:This command only accepts PEM format certificate file as the target.

How to validate a private or public key pairusing OpenSSL

Calculate private key modulus hashvalue:

$ openssl rsa -modulus -noout -in <private key file>| openssl md5

Calculate certificate modulus hashvalue:

$openssl x509 -modulus -noout -in <certificate file> | openssl md5

If the two hash strings are the same, it means the key pair matches. Otherwise, it is not a valid key pair.

Sample output:

openssl rsa -modulus -noout -in server.key | openssl md5(stdin)= b69cd7fc0b07ffef0a577e1e325ab015openssl x509 -modulus -noout -in server.crt | openssl md5(stdin)= b69cd7fc0b07ffef0a577e1e325ab015

Converged Infrastructure, Data Center Infrastructure, Desktops & All-in-Ones, Gateways & Embedded PCs, Electronics & Accessories, Laptops, Networking, Security, Servers, Software, Solutions, Storage, Tablets, Thin Clients, Workstations