openssl x509 is the reference tool for decoding certificates: one flag per question, or -text for the complete dump. These are the invocations that answer 90% of certificate questions at a terminal.

the everyday queries

1openssl x509 -in cert.pem -noout -subject -issuer -dates -serial
2openssl x509 -in cert.pem -noout -fingerprint -sha256
3openssl x509 -in cert.pem -noout -text        # full dump: extensions, SPKI, sig

extract the public key / handle DER input

1openssl x509 -in cert.pem -pubkey -noout > pub.pem  # SPKI public key
2openssl x509 -inform DER -in cert.der -noout -subject  # binary certificates

decode a live server's certificate

1openssl s_client -connect ecdsa.com:443 -servername ecdsa.com </dev/null 2>/dev/null \
2  | openssl x509 -noout -subject -dates -fingerprint -sha256

How it works

-noout suppresses re-printing the PEM itself — combine it with field flags for script-friendly output.
-text shows everything, including extensions (SAN, key usage) and the SubjectPublicKeyInfo with the curve name.
-pubkey extracts the exact SPKI PEM other recipes on this site consume for signature verification and fingerprinting.
openssl x509 reads only the first certificate in a bundle file — to dump a full chain, use openssl storeutl -noout -text chain.pem, which iterates over every block.

Gotchas

PEM is the default -inform; a binary DER certificate fails with unable to load certificate until you add -inform DER — the error message never hints at that.
-fingerprint without -sha256 still uses SHA-1 in many builds — always specify the hash explicitly when comparing fingerprints across tools.
In the -text output, Signature Algorithm appears twice and describes the CA's signature over this certificate — the certificate's own key type is under Subject Public Key Info.

How to decode an X.509 certificate with OpenSSL

How it works

Gotchas

Related recipes