10

Is there an openssl command to extract all certifacte subjects of a cacertfile (a file containing several certificates like /etc/ssl/certs/ca-certificates.crt)?

I tried openssl x509 -in /etc/ssl/certs/ca-certificates.crt -noout -subject but it only gives me the subject of the first certificate.

3 Answers 3

6

To print all subjects within CA file:

openssl crl2pkcs7 -nocrl -certfile ca-certificates.crt | openssl pkcs7 -print_certs -text -noout | grep 'Subject:'

1
  • 1
    Small variation to get it in "distinguished name (DN)" format: openssl crl2pkcs7 -nocrl -certfile ca-certificates.crt | openssl pkcs7 -print_certs -noout | grep subject Oct 20, 2020 at 15:16
5

Unfortunately I don't believe OpenSSL can do that. OpenSSL assumes one cert per file for x509 actions.

According to this site you have to split them into individual files. He even provides a perl script that will split it for you. You could then loop over the files, or modify the perl script to extract the subject directly.

2

Set the file variable to point to your file, modify openssl command and you are good to go:

file="your file name"; first=""; for i in $(grep -n CERT "${file}" | cut -f 1 -d:)
do
    if [ -z "$first" ]
    then
        first=$i
        continue
    fi
    sed -n "$first,${i}p" "${file}" | openssl x509 -noout -subject
    first=""
done
2
  • This answer could be improved by adding a description of how the commands work.  And BTW, you don't need the curly braces in ${file}. Apr 27, 2017 at 3:15
  • this script works exactly as expected, it takes each certificate section out of a (chain) file and shows the subject lines
    – Cie6ohpa
    Jan 10, 2018 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .