Inspect Certificates and Keys Safely with openssl storeutl

openssl storeutl reads certificates, keys and PKCS#12 bundles through one URI-based interface, without ever printing the private material inside them. This guide covers reading a file URI, inspecting a certificate, and examining an encrypted bundle safely. Allow about ten minutes if the files already exist. Ordinary user permissions are enough unless the input or destination is deliberately protected.

1. Check the installed command

This guide is written for the OpenSSL 3.6.1 installation on this machine. The installed manual page is dated 18 August 2026 and the command reports OpenSSL 3.6.1. storeutl was added in OpenSSL 1.1.1, but flags and provider behaviour can vary between releases, so check the local help before moving a script to another host:

$ openssl version
OpenSSL 3.6.1 27 Jan 2026 (Library: OpenSSL 3.6.1 27 Jan 2026)
$ openssl storeutl -help
Usage: storeutl [options] uri

The final argument is always a URI. For local files, use a file: URI, such as file:/srv/tls/issuer.pem, and put every option before it. The local manual specifically warns that options placed after the URI are ignored, which can make a command look like it worked while it silently skips a filter.

$ ls -l /path/to/certificate-or-store
$ test -r /path/to/certificate-or-store && echo readable

Do not reach for sudo as a troubleshooting reflex here. A URI is not a certificate format declaration either: the store loader decides what it can fetch from it, and a PEM certificate, a private key, a certificate revocation list and a PKCS#12 file can all produce different kinds of objects.

2. Inspect a certificate without emitting PEM

Use -text for a human-readable view and -noout to suppress the PEM object. This combination is a useful first pass because it avoids filling a terminal or a log with encoded certificate data:

$ openssl storeutl -noout -text \
    file:/path/to/certificate.pem

For a certificate, expect a numbered object followed by fields such as Issuer, Subject, validity dates, the public-key algorithm and extensions, plus a total such as Total found: 1. The exact serial number and dates depend on your certificate.

-noout is an output choice, not a verification operation. It does not prove a certificate is trusted, valid for a hostname, unexpired or correctly chained: use the separate OpenSSL verification commands for those checks.

3. Read an encrypted PKCS#12 bundle

A PKCS#12 file may hold several objects and may need a password. Pass it through -passin, before the URI. This demonstrative form puts the password on the command line, so use only a throwaway test password and never copy it into a shared shell history or process listing:

$ openssl storeutl -passin pass:REPLACE_WITH_TEST_PASSWORD \
    -noout file:/path/to/bundle.p12

For a bundle containing one private key and one certificate, a successful run on the installed command reports two objects like this:

0: Pkey
1: Certificate
Total found: 2

For a real secret, use a password source supported by your local openssl-passphrase-options(1) documentation rather than exposing the value on the command line. Omit -passin and OpenSSL may prompt interactively; that prompt is expected for encrypted input, not evidence the file is corrupt.

4. Select only the object types you need

-certs, -keys and -crls select certificates, keys or CRLs from the URI, and selection matters most before you use -out, because it limits what gets written. A bundle can still return a set of names or URIs when the URI itself represents names; those are always returned regardless:

$ openssl storeutl -passin pass:REPLACE_WITH_TEST_PASSWORD \
    -certs -noout -text file:/path/to/bundle.p12

Use -keys only when you genuinely need to inspect a key object, and avoid -text in logs for private keys since a text dump can disclose key parameters. Keep inspection output on a terminal with proper access controls, or use -noout when you only need to count or fetch objects.

5. Extract PEM deliberately

Without -noout, the command writes PEM data to standard output by default. -out sends that output to a file instead, which changes state on disk, so pick a new destination and check it before it can overwrite anything useful:

$ openssl storeutl -passin pass:REPLACE_WITH_TEST_PASSWORD \
    -certs -out /path/to/new-certificates.pem \
    file:/path/to/bundle.p12
$ openssl storeutl -noout -text file:/path/to/new-certificates.pem

6. Search a store by identity

For stores that expose searchable objects, use -subject, or -issuer with -serial, -alias or -fingerprint. A subject uses slash-separated attributes. The issuer and serial options must be supplied together, and a serial number can be decimal or hexadecimal when prefixed with 0x:

$ openssl storeutl -subject '/CN=storeutl.example/O=Guide Test' \
    -noout file:/path/to/certificate-or-store
$ openssl storeutl -issuer '/CN=Example Issuer' -serial 0x1234 \
    -noout file:/path/to/certificate-or-store

Quote the subject argument: spaces are retained, and a slash or other special character in a distinguished name may need a backslash escape. A search that finds nothing is a useful result in its own right, worth reporting separately from a loader error, so check the command's exit status in a script rather than matching terminal wording.

Common traps

• Cannot open the URI: check the exact file: spelling, the path, read permission and whether the format is supported by the active providers.
• Encrypted bundle keeps prompting: rerun with the correct -passin source.
• An option seems ignored: do not put -text, -certs or -noout after the URI; the local manual says options there are ignored.
• PEM appears when you wanted only a report: add -noout.
• No PEM appears when you wanted an object: remove -noout and use -out or a carefully chosen redirection.
• A bundle holds several objects: add a type filter and inspect the result before saving it.

-engine is deprecated in OpenSSL 3.0. Prefer the provider options when your deployment needs a particular provider, and check the local openssl(1), provider and property documentation before changing provider selection: loading a provider can change which algorithms or store loaders are available, and it is not a harmless cosmetic setting.