Make OpenSSL Distinguished Names Readable with -nameopt

A certificate's subject printed as one dense string is fine for a machine and useless in an incident channel, and -nameopt is the fix. The examples use the openssl x509 command installed here as OpenSSL 3.0.13, from the Ubuntu package that provides the local openssl-namedisplay-options(1ssl) manual page. Allow about ten minutes. You need a shell and a readable PEM certificate.

1. Check the command and certificate

-nameopt is not a separate executable. It is an option accepted by OpenSSL commands that print subject or issuer names: the local manual describes the available name-format flags, while x509 supplies the certificate data.

$ command -v openssl
/usr/bin/openssl
$ /usr/bin/openssl version
OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024)
$ test -r /path/to/certificate.pem && echo readable
readable

Replace /path/to/certificate.pem with your certificate. These commands only read the certificate and write output to the terminal, so they do not need sudo. If you have no test certificate, use one from a non-sensitive test directory or a public CA certificate already installed on the machine.

2. See the default display

Start with the command's ordinary subject output. The name-display manual calls oneline the default and describes it as a readable one-line format, with short field names such as C, O and CN.

$ /usr/bin/openssl x509 -in /path/to/certificate.pem -noout -subject
subject=C = GB, O = Example Org, CN = example.test

Your values will differ. The subject= prefix comes from x509; -noout suppresses the certificate's PEM output so only the requested field is printed. Add -issuer when you need the issuer instead:

$ /usr/bin/openssl x509 -in /path/to/certificate.pem -noout -issuer
issuer=C = GB, O = Example CA, CN = Example Issuing CA

3. Use multiline output when people need to read it

For incident notes, terminal checks and review logs, multiline separates fields and uses long names with indentation. It is a preset, not a request to wrap an already-rendered line.

$ /usr/bin/openssl x509 -in /path/to/certificate.pem -noout -subject -nameopt multiline
subject=
    countryName               = GB
    organizationName          = Example Org
    commonName                = example.test

The preset includes multiline separators, long field names, alignment and spaces around the equals sign. If you combine flags yourself, the equivalent practical form is:

$ /usr/bin/openssl x509 -in /path/to/certificate.pem -noout -subject \
    -nameopt sep_multiline,lname,align,space_eq

4. Choose RFC 2253 output for machine-facing text

Use the RFC2253 preset when another tool or protocol expects the standard comma-separated representation. It reverses the DN fields, escapes relevant characters and uses short names:

$ /usr/bin/openssl x509 -in /path/to/certificate.pem -noout -subject -nameopt RFC2253
subject=CN=example.test,O=Example Org,C=GB

Do not parse the ordinary oneline display as if it were a stable data format. It is meant to be readable, and its spacing and escaping choices are different. For a script, decide what format the receiving system requires, then test with names containing commas, non-ASCII characters or escaped values before relying on it.

5. Inspect unusual names without guessing

Individual flags let you investigate a name when a preset hides a detail:

• sname uses short attribute names.
• lname uses long names.
• oid prints numerical object identifiers, useful when OpenSSL does not recognise an attribute or when comparing encoded data across systems.

$ /usr/bin/openssl x509 -in /path/to/certificate.pem -noout -subject \
    -nameopt oid,sep_comma_plus
subject=2.5.4.6=GB,2.5.4.10=Example Org,2.5.4.3=example.test

dump_unknown includes fields whose OIDs OpenSSL does not recognise. dump_nostr and dump_all are diagnostic choices for unusual string or non-character fields. Be cautious with output copied into tickets or logs: escaping makes data safer to interpret, but a DN can still contain identifying information.

Common traps

• Treating display options as certificate changes. -nameopt changes how OpenSSL displays a DN. It does not rewrite the certificate, alter its subject, change its issuer or affect trust. Avoid adding certificate-generation options such as -new, -key or -set_subject to a diagnostic command unless you are deliberately creating a new certificate workflow; those operations can create files or replace output, and are outside this guide.
• Redirecting into an existing file carelessly. Shell > truncates an existing file before OpenSSL runs, so choose a new destination first:

$ /usr/bin/openssl x509 -in /path/to/certificate.pem -noout -subject -nameopt multiline \
    > /tmp/subject-name.txt
$ test -s /tmp/subject-name.txt && sed -n '1,6p' /tmp/subject-name.txt

Use a controlled directory for sensitive reports. If the command fails, check the input path and the exact option spelling; the certificate itself has not been changed. Remove a temporary report only once you have confirmed it is no longer needed.