0

Got the cert from a domain in my AWS account, the cert is issued by AWS ACM:

aws acm get-certificate --certificate-arn  arn:aws:acm:us-east-1:...:certificate/... --query CertificateChain |  jq . -r > ca.pem

There are 3 items in that file. I would like to get the issuer and subject for each item in that file. I found the following on the web, and it works ok:

$ openssl crl2pkcs7 -nocrl -certfile ca.pem | openssl pkcs7 -print_certs -noout
subject=C = US, O = Amazon, OU = Server CA 1B, CN = Amazon

issuer=C = US, O = Amazon, CN = Amazon Root CA 1


subject=C = US, O = Amazon, CN = Amazon Root CA 1

issuer=C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2


subject=C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2

issuer=C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority

But, seriously? There is no way to remember this unless you work with that stuff every day. Surely there is something simpler? Another command available on Ubuntu, or maybe a library in Python or Go, or something? anything to make basic cert management simpler than openssl would be much appreciated.

Oliver
  • 27,510
  • 9
  • 72
  • 103

1 Answers1

-1

Here is a free online tool that purports to perform the function you require. Be sure never to paste a secret key into a public website as this.

https://www.sslshopper.com/certificate-decoder.html

Charney Kaye
  • 3,667
  • 6
  • 41
  • 54
johnmgn
  • 52
  • 1
  • 1
    While this web-based tool "gets the job done" it is inadvisable to paste a secret key into an online web tool. There is legitimate risk of exposure to credential harvesting attack. – Charney Kaye Mar 08 '21 at 23:44
  • @CharneyKaye important point you make but luckily here, it is the public portion that would be submitted (because it is the chain of trust) – Oliver Mar 09 '21 at 04:28
  • Good point. Worth adding to the original answer. – Charney Kaye Mar 10 '21 at 01:29