Long story short: Security scan raised a flag about a cert, found that it was an expired root on a cross-signed cert. Yadda yadda, updated intermediates, fixed issue.

However, I noticed that openssl x509 -noout -text intermediate.crt only lists a single signature on the certificate, even though there are two. I've looked over the man page and I can't find an option that prints additional signatures, and google searches are even less useful.

Is there a parser out there somewhere that will list all of the signatures on a certificate? I notice that Qualys enumerates and follows the various cert paths, but I'd prefer not to have to make prod changes to view certificate metadata.


There IS only one signature on an X.509 certificate.

But there can be multiple different certificates for a given CA, and multiple different verification paths using DIFFERENT certificates, with one signature on each certificate. That's what Qualys/ssllabs shows you (when detected).

Usually the CA involved will document this; one of my favorites for clarity is LetsEncrypt. And if your recently-expired bridge was Sectigo-usertrust-under-addtrust, about which maybe a dozen Qs have already been posted, their picture is less clear but their text is good enough (IMO).

Alternatively, now that Certificate Transparency has become common (though not universal) you can usually (though not always) search on one of the logviewers. I find crt.sh most convenient, e.g. https://crt.sh/?q=usertrust%20rsa%20certification%20authority quickly shows the now-expired bridge, the better root, and the new 'alternate' bridge to AAA, as well as the irrelevant Microsoft codesigning endorsement, all with links for details and download if desired.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.