openssl验证证书常用命令

输出x509证书信息

openssl x509 -noout -text  -in ca.pem

结果如下

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:11:aa:b3:70:18:fd:89:b0:25:7a:9e:36:c5:e7:ce:33:5a:cc:b7
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CN, ST=BeiJing, L=BeiJing, O=xx, OU=xx, CN=xx
        Validity
            Not Before: Dec 26 06:17:00 2019 GMT
            Not After : Dec  2 06:17:00 2119 GMT #过期时间
        Subject: C=CN, ST=BeiJing, L=BeiJing, O=xx, OU=xx, CN=xx
        Subject Public Key Info:
        ...

验证公钥私钥是否匹配

diff -eq <(openssl x509 -pubkey -noout -in cert.crt) <(openssl rsa -pubout -in cert.key)

正常会输出

writing RSA key

验证证书CA

openssl verify -CAfile ca.pem client.pem

正常输出

client.pem: OK