OpenSSL will allow you to look at it if it is installed on your system, using the OpenSSL x509 tool.
openssl x509 -noout -text -in 'cerfile.cer';
The format of the .CER file might require that you specify a different encoding format to be explicitly called out.
openssl x509 -inform pem -noout -text -in 'cerfile.cer';
or
openssl x509 -inform der -noout -text -in 'cerfile.cer';
On Windows systems you can right click the .cer file and select Open. That will then let you view most of the meta data.
On Windows you run Windows certificate manager program using certmgr.msc command in the run window. Then you can import your certificates and view details.
Answer from Helvick on serverfault.comOpenSSL will allow you to look at it if it is installed on your system, using the OpenSSL x509 tool.
openssl x509 -noout -text -in 'cerfile.cer';
The format of the .CER file might require that you specify a different encoding format to be explicitly called out.
openssl x509 -inform pem -noout -text -in 'cerfile.cer';
or
openssl x509 -inform der -noout -text -in 'cerfile.cer';
On Windows systems you can right click the .cer file and select Open. That will then let you view most of the meta data.
On Windows you run Windows certificate manager program using certmgr.msc command in the run window. Then you can import your certificates and view details.
If you're using Windows, you can use console util (PowerShell or Command Prompt)
certutil -dump C:\path\certfile.cer
With SNI
If the remote server is using SNI (that is, sharing multiple SSL hosts on a single IP address) you will need to send the correct hostname in order to get the right certificate.
openssl s_client -showcerts -servername www.example.com -connect www.example.com:443 </dev/null
If you get an error similar to xxx:error:xxx:BIO routines:BIO_lookup_ex:system lib:crypto/bio/bio_addr.c:758:nodename nor servname provided, or not known connect:errno=0, execute the same command without www as the domain may not support it.
You may also get Secure Renegotiation IS NOT supported behind a corporate firewall in which case, a temporary (but dangerous) workaround is the -legacy_renegotiation parameter that can be added to the above command.
Without SNI
If the remote server is not using SNI, then you can skip -servername parameter:
openssl s_client -showcerts -connect www.example.com:443 </dev/null
To view the full details of a site's cert you can use this chain of commands as well:
$ echo | \
openssl s_client -servername www.example.com -connect www.example.com:443 2>/dev/null | \
openssl x509 -text
A one-liner to extract the certificate from a remote server in PEM format, this time using sed:
openssl s_client -connect www.google.com:443 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
Videos
Assuming your certificates are in PEM format, you can do:
openssl verify cert.pem
If your "ca-bundle" is a file containing additional intermediate certificates in PEM format:
openssl verify -untrusted ca-bundle cert.pem
If your openssl isn't set up to automatically use an installed set of root certificates (e.g. in /etc/ssl/certs), then you can use -CApath or -CAfile to specify the CA.
Here is one-liner to verify a certificate chain:
openssl verify -verbose -x509_strict -CAfile ca.pem -CApath nosuchdir cert_chain.pem
This doesn't require to install CA anywhere.
See https://stackoverflow.com/questions/20409534/how-does-an-ssl-certificate-chain-bundle-work for details.
Update
As noted by Klaas van Schelven, the answer above is misleading as openssl appears to verify only single top certificate per file. So it's necessary to issue multiple verify commands for each certificate chain node placed in separate file.
From verify documentation:
If a certificate is found which is its own issuer it is assumed to be the root CA.
In other words, root CA needs to be self signed for verify to work. This is why your second command didn't work. Try this instead:
openssl verify -CAfile RootCert.pem -untrusted Intermediate.pem UserCert.pem
It will verify your entire chain in a single command.
That's one of the few legitimate jobs for cat:
openssl verify -verbose -CAfile <(cat Intermediate.pem RootCert.pem) UserCert.pem
Update:
As Greg Smethells points out in the comments, this command implicitly trusts Intermediate.pem. I recommend reading the first part of the post Greg references (the second part is specifically about pyOpenSSL and not relevant to this question).
In case the post goes away I'll quote the important paragraphs:
Unfortunately, an "intermediate" cert that is actually a root / self-signed will be treated as a trusted CA when using the recommended command given above:
$ openssl verify -CAfile <(cat geotrust_global_ca.pem rogue_ca.pem) fake_sometechcompany_from_rogue_ca.com.pem fake_sometechcompany_from_rogue_ca.com.pem: OK
It seems openssl will stop verifying the chain as soon as a root certificate is encountered, which may also be Intermediate.pem if it is self-signed. In that case RootCert.pem is not considered. So make sure that Intermediate.pem is coming from a trusted source before relying on the command above.
Use showcerts:
openssl s_client -showcerts -connect www.serverfault.com:443
Output with some information removed for brevity:
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = *.stackexchange.com
verify return:1
---
Certificate chain
0 s:/CN=*.stackexchange.com
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
-----BEGIN CERTIFICATE-----
*REMOVED*
-----END CERTIFICATE-----
1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
-----BEGIN CERTIFICATE-----
*REMOVED*
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=*.stackexchange.com
issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: X25519, 253 bits
From a certificate bundle, you can use crl2pkcs7 that is not limited to a CRL:
openssl crl2pkcs7 -nocrl -certfile server_bundle.pem | openssl pkcs7 -print_certs -noout
From a live server, we need an additional stage to get the list:
echo | openssl s_client -connect host:port [-servername host] -showcerts | openssl crl2pkcs7 -nocrl | openssl pkcs7 -noout -print_certs
Use the -servername parameter in case your host serves multiple domains to get the right certificate.