I can't see certificate chain into pem certificate file

Question

I have a certificate file called customer_pem.cert . This file has PEM format. It contains three ---BEGIN CERTIFICATE-- sections (end user certificate, CA intermediate certificate and CA certificate). I'm using Windows 10. When I make double click over the file and I go to Certification Path section, I don't see the see the complete hierarchy or certificate chain. I just see the end user certificate. I don't see the CA and CA intermediate certificates.

The question is why I can't see them?

Answer 1

The question is why I can't see them?

answered by @Daniel

To see a chain of certificate you need to do the following

Using Keytool

1. Download and Install Java JRE

Download from here https://www.java.com/en/download/manual.jsp

Or dowload Open JDK instead https://adoptium.net/temurin/releases/

select OS and Arch according to your system.

2. Make sure your Java/OpenJDK bin Directory registered in PATH Environment Variable

I don't know how installation behave, just make sure %ProgramFiles%\Java\jre#.#.#_###\bin\ or %ProgramFiles%\Eclipse Adoptium\jre-#.#.#.##-hotspot\ is in your PATH Environment Variable. Add if it isn't there.

Follow this tutorial if you're not familiar to edit an Environment Variable.

Or this if you want to do it from cmd shell.

3. Use Keytool to show your certificate chain

Keytool come with Java JRE and OpenJDK JRE, that's why we do the 1st step.

Open CMD, and execute the following:

keytool -printcert -file "path-to-pem/chain-of-cert.pem" -v

Using OpenSSL

1. Download and or Extract/Install Pre-built OpenSSL

Download from here (portable zip file)

Or download from here (installer exe/msi file, the lite version should be fine)

Choose according to your system OS and Arch

2. Make sure your OpenSSL directory is in your PATH Environment Variable

Just like step 2 of Keytool Method, I don't know how installation behave, just make sure the directory where openssl.exe placed is in your PATH Environment Variable. Add if it isn't there.

Follow this tutorial if you're not familiar to edit an Environment Variable.

Or this if you want to do it from cmd shell.

3. Use OpenSSL to show your certificate chain

Open CMD, and execute the following:

openssl crl2pkcs7 -nocrl -certfile "path-to-pem/chain-of-cert.pem" | openssl pkcs7 -print_certs -text -noout

OR

openssl storeutl -noout -text -certs "path-to-pem/chain-of-cert.pem"

Answer 2

It is possible to get the entire cert chain in .pem format with Mozilla browser..

• Step1: click on padlock icon > Connection secure

  

• Step2: Click More information

  

• Step3: Under Security tab, click View Certificate

  

• Step4: Scroll down, and under Miscellaneous, you'll see PEM chain

  

• Step5: Click that to open in any text editor and you will have the entire cert chain.

Answer 3

Windows has no default viewer for .pem files. You need to split the file in separate files with the extension .cer.