Verify cert against CA

Check certificate chain against a CA bundle

openssl verify -CAfile ca.pem cert.pem

More openssl commands

Check cert matches key

diff <(openssl x509 -pubkey -noout -in cert.pem) <(openssl pkey -pubout -in key.pem) && echo 'MATCH'

Confirm the cert and private key are a pair
Convert PEM to PKCS#12

openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca.pem -out bundle.p12 -name myalias

Package cert + key + CA into a .p12 file
Extract cert from PKCS#12

openssl pkcs12 -in bundle.p12 -nokeys -out cert.pem && openssl pkcs12 -in bundle.p12 -nocerts -nodes -out key.pem

Split .p12 into separate cert and key PEM files
Check live TLS cert

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Show expiry and issuer of a live TLS certificate
Check full cert chain

openssl s_client -connect example.com:443 -showcerts 2>/dev/null | openssl crl2pkcs7 -nocrl | openssl pkcs7 -print_certs -noout -text | grep -E 'Subject:|Issuer:'

Display full chain: leaf → intermediate → root