How to Check a Certificate's Details, SAN and Expiry
Every TLS connection stands or falls on the details inside an X.509 certificate. A certificate that expired yesterday, was issued for the wrong name, or is missing the IP address your device connects to will be rejected — usually with a vague error. This guide shows how to read a certificate properly: which fields matter, what they should contain, and how to check them.
The fields that matter most
| Field | What it tells you | What goes wrong |
|---|---|---|
| Subject (CN) | Who the certificate was issued to. The Common Name is traditional; modern clients mostly ignore it in favour of the SAN. | CN says one host, devices connect to another. |
| SAN (Subject Alternative Name) | The DNS names and IP addresses the certificate is actually valid for. This is the field browsers and devices verify during the handshake. | The name or IP you connect to is not listed → name-mismatch error, even if the CN looks right. |
| Issuer | Which CA signed the certificate. The client must trust this CA, directly or through a chain. | Self-signed or unknown CA → "untrusted" errors. |
| Validity (Not Before / Not After) | The window in which the certificate may be used. | Expired certificate, or a device clock set wrong so a valid certificate looks expired or "not yet valid". |
| Key Usage / Extended Key Usage | What the certificate is allowed to do: serverAuth for servers, clientAuth for client certificates, keyCertSign for CAs. | A client certificate without clientAuth is rejected by servers that enforce usage checks. |
| Basic Constraints | Whether this is a CA certificate (CA:TRUE) or an end-entity certificate (CA:FALSE). | A "CA" that is not marked CA:TRUE cannot issue trusted certificates. |
| Fingerprints (SHA-256 / SHA-1) | A hash of the whole certificate — the reliable way to confirm two copies are the same certificate. | Comparing file names instead of fingerprints leads to deploying the wrong certificate. |
Check a certificate in your browser (no commands)
- Open the CertView viewer.
- Drag the certificate file in — .pem, .crt, .cer, .der, or a .pfx/.p12 bundle (you will be asked for its password). You can also drop a whole chain file; every certificate in it is listed.
- Read the summary line first: it flags expired, not-yet-valid and CA certificates. Then check SAN, issuer, key usage and the SHA-256 fingerprint.
- Optional: also drag in the issuing CA certificate to have the signature chain verified, and a .key file to check the private key matches.
All parsing happens locally in your browser — the file is never uploaded — so the tool is safe for internal, test and device certificates.
Check a certificate with OpenSSL
The command-line equivalent prints the same fields:
openssl x509 -in certificate.crt -text -noout
openssl x509 -in certificate.crt -noout -subject -issuer -dates
openssl x509 -in certificate.crt -noout -ext subjectAltName
openssl x509 -in certificate.crt -noout -fingerprint -sha256For a DER-encoded file add -inform DER. To inspect the certificate a live server presents:
openssl s_client -connect example.com:443 -servername example.comA quick pre-deployment checklist
- The DNS name or IP address you will connect to appears in the SAN list.
- The certificate is in date — and the clocks on both endpoints are correct.
- The issuer is the CA the other side trusts; the chain verifies.
- Server certificates carry serverAuth; client certificates carry clientAuth; CAs are marked CA:TRUE.
- The private key on the device matches this certificate (see our key-match guide) — and you confirmed it by fingerprint, not by filename.
如何查看证书的详细信息、SAN 和有效期
每一个 TLS 连接的成败都取决于一张 X.509 证书里的细节。一张昨天刚过期的证书、一张签发给错误名称的证书，或者一张缺少你的设备要连接的 IP 地址的证书，都会被拒绝——而且通常只给一个含糊的报错。本指南教你如何正确读懂一张证书：哪些字段重要、它们应该包含什么、以及如何检查它们。
最重要的几个字段
| 字段 | 它告诉你什么 | 哪里容易出问题 |
|---|---|---|
| 主体（Subject，CN） | 这张证书签发给了谁。通用名（Common Name）是传统字段；现代客户端大多会忽略它，转而看 SAN。 | CN 写的是一个主机，设备却连的是另一个。 |
| 主体备用名称 (Subject Alternative Name, SAN) | 这张证书实际对哪些 DNS 名称和 IP 地址有效。这是浏览器和设备在握手时校验的字段。 | 你要连接的名称或 IP 不在列表里 → 名称不匹配错误，哪怕 CN 看起来是对的。 |
| 颁发者（Issuer） | 哪个 CA 签发了这张证书。客户端必须直接或通过证书链信任这个 CA。 | 自签名或未知 CA → “不受信任”错误。 |
| 有效期（Validity，Not Before / Not After） | 可以使用这张证书的时间窗口。 | 证书已过期；或设备时钟设置错误，使一张有效证书看起来像已过期或“尚未生效”。 |
| 密钥用法（Key Usage）/ 增强型密钥用法（Extended Key Usage） | 这张证书被允许做什么：服务器证书用 serverAuth，客户端证书用 clientAuth，CA 用 keyCertSign。 | 没有 clientAuth 的客户端证书会被执行用途检查的服务器拒绝。 |
| 基本约束（Basic Constraints） | 这是 CA 证书（CA:TRUE）还是终端实体证书（CA:FALSE）。 | 没有标为 CA:TRUE 的“CA”无法签发受信任的证书。 |
| 指纹（Fingerprints，SHA-256 / SHA-1） | 整张证书的哈希值——确认两份副本是同一张证书的可靠方法。 | 拿文件名而不是指纹来对比，会导致部署错证书。 |
在浏览器里查看证书（不用敲命令）
- 打开 CertView 查看器。
- 把证书文件拖进去——.pem、.crt、.cer、.der，或者 .pfx/.p12 证书包（会要求你输入它的密码）。你也可以拖入一整个证书链文件；里面的每一张证书都会被列出来。
- 先看顶部的结论行：它会标出已过期、尚未生效和 CA 证书。然后再检查 SAN、颁发者、密钥用法和 SHA-256 指纹。
- 可选：再把签发它的 CA 证书也拖进来，工具会核对签名链；再拖入一个 .key 文件，可以核对私钥是否配对。
所有解析都在你的浏览器本地完成——文件从不上传——所以这个工具可以放心用于内部、测试和设备证书。
用 OpenSSL 查看证书
命令行方式可以打印出同样的字段：
openssl x509 -in certificate.crt -text -noout
openssl x509 -in certificate.crt -noout -subject -issuer -dates
openssl x509 -in certificate.crt -noout -ext subjectAltName
openssl x509 -in certificate.crt -noout -fingerprint -sha256对于 DER 编码的文件，加上 -inform DER。要查看一台在线服务器实际出示的证书：
openssl s_client -connect example.com:443 -servername example.com部署前快速检查清单
- 你要连接的 DNS 名称或 IP 地址出现在 SAN 列表里。
- 证书在有效期内——并且两端设备的时钟都正确。
- 颁发者是对方信任的那个 CA；证书链核对通过。
- 服务器证书带 serverAuth；客户端证书带 clientAuth；CA 标为 CA:TRUE。
- 设备上的私钥与这张证书配对（见我们的私钥配对指南）——并且你是用指纹确认的，不是用文件名。
立即试用：打开 CertView 证书查看器，把证书文件拖进去，文中讲的每个字段都会立刻解码出来——全程在你的浏览器里完成，不上传任何东西。Try it now: open the CertView certificate viewer, drag your certificate file in, and every field in this guide is decoded instantly — in your browser, with nothing uploaded.