how to read the keyusage of a X509 V3 certificate?

Question

I want to read the Key usage field in a certificate .is there an API is available in openssl ?

Answer 1

You can try using the following command in openssl.

openssl x509 -in <certificate to check> -purpose -noout -text

This would print out the list of certificate purpose and the certificate itself.

Answer 2

7 years later...

Newer versions of openssl let you query certificate extensions using -ext flag. See docs for available options.

Print key usage:

$> openssl x509 -noout -ext keyUsage < test.crt
X509v3 Key Usage: critical
    Digital Signature, Key Encipherment

Print extended key usage:

$> openssl x509 -noout -ext extendedKeyUsage < test.crt
X509v3 Extended Key Usage: 
    TLS Web Server Authentication, TLS Web Client Authentication

Note that if you want to print multiple extensions at once, you need to separate than by comma instead of using -ext flag multiple times:

$> openssl x509 -noout \
   -ext keyUsage,extendedKeyUsage < test.crt