Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SSL CRT file in PEM format. Is there a way that I can extract the common name (CN) from the certificate from the command line?

share|improve this question
up vote 12 down vote accepted

If you have openssl installed you can run:

openssl x509 -noout -subject -in server.pem
share|improve this answer
You can extract the CN out of the subject with: openssl x509 -noout -subject -in server.pem | sed -n '/^subject/s/^.*CN=//p' – Matthew Buckett Dec 4 '14 at 12:09
I modified what @MatthewBuckett said and used sed -e 's/^subject.*CN=\([a-zA-Z0-9\.\-]*\).*$/\1/' to get just the domain as I had additional details after the CN. Its not super strict matching for a valid CN but in most cases it works, you could be more slack and replace [a-zA-Z0-9\.\-] with [^/] but I am not certain that would always work. – flungo Jun 4 '15 at 16:11
Add \* to what @flungo used to support wildcard domains: sed -e 's/^subject.*CN=\([a-zA-Z0-9\.\-\*]*\).*$/\1/' ([^/] works in my case, though) – bryn Sep 12 '15 at 23:18
certtool -i < whatever.pem

Notice that's directing the file to standard input via <, not using it as argument. This will print the whole certificate out, the CN is near the top:

X.509 Certificate Information:
    Version: 3
    Serial Number (hex): 01
    Issuer: CN=goldilocks

certtool is part of gnutls, if it is not installed just search for that. GnuTLS is a little nicer than OpenSSL, IMO.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.