Read X.509 certificate SAN’s othername field using OpenSSL

Public Key Infrastrucutre (PKI) is commonly used for HTTPS. It’s basic idea states that we have private and public key, where private is only known by its owner. In case of secure websites public keys are known as certificates. Having certificate in PEM format and using openssl command we can show its data:

# openssl x509 -text -noout -in certificate.pem

Unfortunatelly, not everything is shown by default. Certificates may have encoded extensions like X509v3 Subject Alternative Name. One of the extension types is otherName is not decoded with above command. The only output we will see looks like this.

  ...
    X509v3 Subject Alternative Name: 
      othername:<unsupported>, othername:<unsupported>
  ...

As it states here it is because the format may be totally arbitrary.

Fortunatelly, there is a way to decode it using asn1parse subcommand. First, lets see output of the command:

# openssl asn1parse -in certificate.pem

Of course, it may differ based on certificate, but you should see something like that.

...
  700:d=4  hl=2 l= 109 cons: SEQUENCE          
  702:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Subject Alternative Name
  707:d=5  hl=2 l= 100 prim: OCTET STRING      [HEX DUMP]:0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF01234567
  907:d=1  hl=2 l=  13 cons: SEQUENCE   
...

OpenSSLs asn1parse always prints certificate’s extensions like this, because there are encoded as OCTET STRINGs. To see what is inside use -strparse option and an offset read from the begining of the output’s line (here it is 707).

# openssl asn1parse -in certificate.pem -strparse 707

    0:d=0  hl=2 l= 100 cons: SEQUENCE          
    2:d=1  hl=2 l=  47 prim: cont [ 2 ]        
   51:d=1  hl=2 l=   4 prim: cont [ 7 ]        
   57:d=1  hl=2 l=  29 cons: cont [ 0 ]        
   59:d=2  hl=2 l=   3 prim: OBJECT            :1.2.3.4
   64:d=2  hl=2 l=  22 cons: cont [ 0 ]        
   66:d=3  hl=2 l=  20 prim: UTF8STRING        :some-testing-value-1
   88:d=1  hl=2 l=  12 cons: cont [ 0 ]        
   90:d=2  hl=2 l=   3 prim: OBJECT            :1.2.3.5
   95:d=2  hl=2 l=   5 cons: cont [ 0 ]        
   97:d=3  hl=2 l=  13 prim: UTF8STRING        :other-value-2

Finally, some human readable form which is much nicer.