How to Check Your PKI Certificate Status and Details

Checking your Public Key Infrastructure (PKI) certificate involves verifying its validity, details, and ensuring it is correctly issued and configured. The method for checking a certificate depends on where it is stored or used, whether it's on a personal device, a server, or within a cloud environment.

1. Checking Certificates in Cloud PKI Environments

For organizations utilizing cloud-based PKI solutions, such as those integrated with device management platforms, dedicated monitoring tools are available.

• Access Monitoring Dashboards: Each Cloud PKI issuing Certificate Authority (CA) typically provides a monitoring dashboard.
• View Issued Certificates: Within these dashboards, you can often find an option to "View all certificates," which displays a comprehensive list of all certificates that have been issued.
• Review Certificate Reports: Detailed reports about issued certificates, including their status and device association, are generally available within 24 hours of the certificate being successfully issued to a device.
• Manage Certificates: From this centralized view, administrators can also perform management actions, such as manually revoking an issued leaf certificate if needed.

2. Checking Certificates on Your Computer

Whether on Windows, macOS, or Linux, your operating system provides built-in tools to inspect certificates stored on your device.

2.1 On Windows

Windows uses a Certificate Manager tool to view and manage certificates.

• Using Certificate Manager (MMC):
  1. Press Win + R, type certmgr.msc, and press Enter. This opens the Certificate Manager console.
  2. In the left pane, navigate to Personal > Certificates to view certificates specific to your user account. For machine-level certificates, navigate to Certificates (Local Computer) via mmc.exe and adding the Certificates snap-in.
  3. Double-click on any certificate to view its details, including:
     • General: Basic information like friendly name and purpose.
     • Details: Comprehensive fields like Subject, Issuer, Serial Number, Thumbprint, Public Key, and Validity Period.
     • Certification Path: The chain of trust, showing the certificate's lineage from the root CA.

2.2 On macOS

macOS uses the Keychain Access utility to store and manage certificates, passwords, and other secure notes.

• Using Keychain Access:
  1. Open Finder, navigate to Applications > Utilities, and then open Keychain Access.
  2. In the left sidebar, select Certificates under Category or select the specific keychain (e.g., login or System).
  3. Double-click on a certificate to open its inspector window, where you can view details such as Trust, Details, and Extensions.

2.3 On Linux

Linux systems often rely on command-line tools like OpenSSL to inspect certificate files.

• Using OpenSSL:
  To inspect a certificate file (e.g., mycertificate.crt):

  openssl x509 -in mycertificate.crt -text -noout

  This command outputs the certificate's decoded content, showing its version, serial number, issuer, validity period, subject, public key, extensions, and signature.

3. Checking Website PKI Certificates (SSL/TLS Certificates)

When you visit a secure website (HTTPS), your web browser automatically checks its SSL/TLS certificate. You can manually inspect these certificates for details and trust.

• Using Web Browsers (Chrome, Firefox, Edge, Safari):
  1. Click the padlock icon (🔒) in the browser's address bar, typically to the left of the URL.
  2. Select "Connection is secure," "Certificate," or a similar option (wording may vary slightly by browser).
  3. This will open a dialog box displaying key information about the website's certificate, including:
     • Issuer: The Certificate Authority that issued the certificate.
     • Subject: The domain name(s) the certificate is issued for.
     • Validity Period: The dates between which the certificate is valid.
     • Certificate Path: The chain of trust from the website's certificate up to the root CA.
  4. You can often click "Details" or "More information" to see advanced fields like the public key, serial number, and certificate policies.

4. Key Details to Look For When Checking a Certificate

When inspecting a PKI certificate, pay attention to the following crucial fields:

• Subject: Identifies the entity (person, device, or organization) the certificate is issued to.
• Issuer: Identifies the Certificate Authority (CA) that issued the certificate.
• Valid From / Valid To: The period during which the certificate is considered valid. An expired certificate is untrusted.
• Serial Number: A unique identifier assigned by the CA to each certificate it issues.
• Thumbprint / Fingerprint: A cryptographic hash of the entire certificate, often used for quick identification or verification.
• Public Key: The public portion of the cryptographic key pair, used for encryption or signature verification.
• Key Usage / Extended Key Usage: Defines the purpose(s) for which the certificate's public key can be used (e.g., digital signature, key encipherment, client authentication, server authentication).
• Certificate Path / Chain of Trust: Shows the hierarchical relationship from the end-entity certificate back to a trusted Root CA. A broken or incomplete chain can lead to trust errors.

By understanding these methods and key details, you can effectively check and verify your PKI certificates across various platforms and applications.