Inspect live server chain openssl
Fetch full chain with SNI; -servername is mandatory for vhosts/SNI backends
openssl s_client -connect <host>:443 -servername <host> -showcerts </dev/null 2>/dev/null
more openssl
all 27 commands →
Extract SAN list
openssl x509 -in cert.pem -noout -ext subjectAltName
Verify cert against CA chain
openssl verify -CAfile ca-chain.pem cert.pem
Match cert and private key
diff <(openssl x509 -in cert.pem -noout -modulus | md5sum) <(openssl rsa -in key.pem -noout -modulus | md5sum)
CSR + key in one shot
openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.csr -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"
Self-signed cert with SAN
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"