1

I have a certificate file called customer_pem.cert . This file has PEM format. It contains three ---BEGIN CERTIFICATE-- sections (end user certificate, CA intermediate certificate and CA certificate). I'm using Windows 10. When I make double click over the file and I go to Certification Path section, I don't see the see the complete hierarchy or certificate chain. I just see the end user certificate. I don't see the CA and CA intermediate certificates.

The question is why I can't see them?

user3637971
  • 313
  • 5
  • 21

3 Answers3

2

It is possible to get the entire cert chain in .pem format with Mozilla browser..

  • Step1: click on padlock icon > Connection secure

    enter image description here

  • Step2: Click More information

    enter image description here

  • Step3: Under Security tab, click View Certificate

    enter image description here

  • Step4: Scroll down, and under Miscellaneous, you'll see PEM chain

    enter image description here

  • Step5: Click that to open in any text editor and you will have the entire cert chain.

dgor
  • 704
  • 6
  • 19
1

Windows has no default viewer for .pem files. You need to split the file in separate files with the extension .cer.

Daniel Fisher lennybacon
  • 3,865
  • 1
  • 30
  • 38
1

The question is why I can't see them?

answered by @Daniel

To see a chain of certificate you need to do the following

Using Keytool

1. Download and Install Java JRE

Download from here https://www.java.com/en/download/manual.jsp

Or dowload Open JDK instead https://adoptium.net/temurin/releases/

select OS and Arch according to your system.

2. Make sure your Java/OpenJDK bin Directory registered in PATH Environment Variable

I don't know how installation behave, just make sure %ProgramFiles%\Java\jre#.#.#_###\bin\ or %ProgramFiles%\Eclipse Adoptium\jre-#.#.#.##-hotspot\ is in your PATH Environment Variable. Add if it isn't there.

Follow this tutorial if you're not familiar to edit an Environment Variable.

Or this if you want to do it from cmd shell.

3. Use Keytool to show your certificate chain

Keytool come with Java JRE and OpenJDK JRE, that's why we do the 1st step.

Open CMD, and execute the following:

keytool -printcert -file "path-to-pem/chain-of-cert.pem" -v

Using OpenSSL

1. Download and or Extract/Install Pre-built OpenSSL

Download from here (portable zip file)

Or download from here (installer exe/msi file, the lite version should be fine)

Choose according to your system OS and Arch

2. Make sure your OpenSSL directory is in your PATH Environment Variable

Just like step 2 of Keytool Method, I don't know how installation behave, just make sure the directory where openssl.exe placed is in your PATH Environment Variable. Add if it isn't there.

Follow this tutorial if you're not familiar to edit an Environment Variable.

Or this if you want to do it from cmd shell.

3. Use OpenSSL to show your certificate chain

Open CMD, and execute the following:

openssl crl2pkcs7 -nocrl -certfile "path-to-pem/chain-of-cert.pem" | openssl pkcs7 -print_certs -text -noout

OR

openssl storeutl -noout -text -certs "path-to-pem/chain-of-cert.pem"
Akbar Nur Pribadi
  • 13
  • 3