deep dive
How to Read an SSL Certificate: Every X.509 Field Explained (2026)
An SSL/TLS certificate is an X.509 structured data file. When you open one with OpenSSL, you see dozens of fields: version numbers, hexadecimal serial numbers, OIDs (Object Identifiers), ASN.1 encoded public keys, and extensions with cryptic names like id-pe-authorityInfoAccess. This guide translates all of it into plain English.
The OpenSSL Command to See Everything
The single most useful command for reading an SSL certificate is openssl x509 -text -noout. It outputs the complete decoded certificate in human-readable form:
openssl x509 -text -noout -in yourdomain.crt
# Or read directly from a live server (no file needed):
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -text -noout
X.509 Certificate Fields Explained
| Field | Example Value | What It Means |
|---|---|---|
| Version | 3 (0x2) | Always Version 3 for modern certificates. Version 3 introduced extensions (SANs, key usage, etc.). Version 1 certs have no extensions. |
| Serial Number | 0a:1b:2c:3d:... | Unique identifier assigned by the CA. Used in CRL (Certificate Revocation List) entries. No two certificates from the same CA should share a serial number. |
| Signature Algorithm | sha256WithRSAEncryption | The algorithm used to sign the certificate. SHA-256 is the current standard. SHA-1 certificates are rejected by modern browsers since 2017. |
| Issuer | C=US, O=Let's Encrypt, CN=R11 | The CA that signed this certificate. For DV certificates, this is typically an intermediate CA (not the root). For self-signed certs, Issuer = Subject. |
| Validity: Not Before | Jul 15 00:00:00 2026 GMT | Certificate is invalid before this date. Most CAs back-date this by a few hours to account for clock skew between servers. |
| Validity: Not After | Oct 15 00:00:00 2026 GMT | Certificate expires at this UTC timestamp. After this point, browsers show a hard error — no user override. Let's Encrypt certs are 90 days; commercial certs are up to 398 days. |
| Subject | CN=yourdomain.com, O=Acme Corp, C=US | The identity the certificate vouches for. CN (Common Name) is the primary domain. O (Organization), C (Country) are only present on OV and EV certificates — DV certs only have CN. |
| Public Key | RSA Public-Key: (2048 bit) / id-ecPublicKey prime256v1 | The public half of the key pair. RSA 2048-bit is the most common. ECC P-256 (prime256v1) is faster and recommended for new deployments. The private key never appears in the certificate. |
X.509 v3 Extensions Explained
Extensions are the most important part of modern certificates. They define what the certificate can be used for, which domains it covers, and where to find revocation information.
| Extension | Example Value | What It Means |
|---|---|---|
| Subject Alternative Name | DNS:yourdomain.com, DNS:www.yourdomain.com | The domains this certificate is actually valid for. The CN field is largely ignored by browsers — the SAN list is what matters. Wildcard entries appear as DNS:*.yourdomain.com. |
| Key Usage | Digital Signature, Key Encipherment | What cryptographic operations are permitted. TLS server certs need Digital Signature (for ECDHE key exchange) and Key Encipherment (for RSA key exchange). Certificate Signing is only allowed for CA certs. |
| Extended Key Usage | TLS Web Server Authentication (1.3.6.1.5.5.7.3.1) | OIDs (Object Identifiers) that specify the certificate's purpose. Web server certs must have the Server Authentication OID. Code signing certificates have a different OID. |
| Basic Constraints | CA:FALSE | CA:FALSE means this certificate cannot sign other certificates. CA:TRUE marks a Certificate Authority cert. End-entity (server) certificates must have CA:FALSE. |
| Authority Information Access | OCSP - http://ocsp.ca.com CA Issuers - http://ca.com/issuer.crt |
OCSP URL: where browsers check real-time revocation status. CA Issuers URL: where clients can download the intermediate certificate if it's missing from the chain. |
| CRL Distribution Points | http://crl.ca.com/latest.crl | URL for the Certificate Revocation List — a file the CA publishes listing all revoked certificates. Older revocation method; OCSP is now preferred because CRL files can be large. |
| Certificate Policies | Policy: 2.23.140.1.2.1 | OIDs identifying the validation level: 2.23.140.1.2.1 = Domain Validation (DV), 2.23.140.1.2.2 = Organization Validation (OV), 2.23.140.1.1 = Extended Validation (EV). |
| CT Precertificate SCTs | Signed Certificate Timestamp List | Certificate Transparency proofs — timestamps from public CT logs proving this certificate was logged before issuance. Required by Chrome since 2018. Embedded SCTs or delivered via TLS extension. |
OpenSSL Commands for Specific Fields
# Subject (domain + organization):
openssl x509 -noout -subject -in yourdomain.crt
# Issuer (which CA signed it):
openssl x509 -noout -issuer -in yourdomain.crt
# Validity dates:
openssl x509 -noout -dates -in yourdomain.crt
# Subject Alternative Names (SANs — the actual valid domains):
openssl x509 -noout -ext subjectAltName -in yourdomain.crt
# SHA-256 fingerprint:
openssl x509 -noout -fingerprint -sha256 -in yourdomain.crt
# Certificate Policies OID (DV / OV / EV):
openssl x509 -noout -text -in yourdomain.crt | grep -A2 "Certificate Policies"
# Public key algorithm and size:
openssl x509 -noout -text -in yourdomain.crt | grep -A2 "Public Key"
Viewing Certificate Fields on Windows
Windows
PowerShell / GUI
Windows has both a GUI and PowerShell methods for reading certificate fields.
PowerShell
# Read a certificate file
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\path\yourdomain.crt")
# View key fields
Write-Host "Subject: $($cert.Subject)"
Write-Host "Issuer: $($cert.Issuer)"
Write-Host "Not Before: $($cert.NotBefore)"
Write-Host "Not After: $($cert.NotAfter)"
Write-Host "Thumbprint: $($cert.Thumbprint)"
Write-Host "Serial Number: $($cert.SerialNumber)"
Write-Host "Key Algorithm: $($cert.PublicKey.Oid.FriendlyName)"
# View Subject Alternative Names
$sanExt = $cert.Extensions | Where-Object {$_.Oid.Value -eq "2.5.29.17"}
if ($sanExt) {
Write-Host "SANs: $($sanExt.Format($false))"
}
# View all extensions
$cert.Extensions | ForEach-Object {
Write-Host "$($_.Oid.FriendlyName): $($_.Format($false))"
}
Windows GUI (certmgr.msc / Double-click method)
Double-click any .crt or .cer file in Windows Explorer to open the certificate viewer. The Details tab shows every field in a structured list. Click any field to see its raw value in the box below.
Or install OpenSSL via winget install ShiningLight.OpenSSL and use the same openssl x509 commands shown above — they work identically on Windows.
Viewing Certificate Fields on macOS
macOS
Terminal / Keychain
# macOS Terminal (uses LibreSSL — compatible with openssl x509 commands):
openssl x509 -text -noout -in yourdomain.crt
# Or install full OpenSSL for all flags:
brew install openssl
/opt/homebrew/opt/openssl/bin/openssl x509 -text -noout -in yourdomain.crt
# View from a live server:
openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -text -noout
You can also view certificates in Keychain Access: drag the .crt file onto the Keychain Access window, then double-click the certificate to see all fields in a structured inspector. Every X.509 field shown in the table above has a corresponding entry in the Keychain viewer.
Decode your SSL certificate in the browser
Our SSL checker parses all X.509 fields and flags any issues — no OpenSSL installation needed.