3

When I check details of a certificate I only see information about the certificate itself. Is there any way to see the issuer’s certificate? In my case it’s an intermediate CA. The certificate that I care is for S/MIME (hence the tag), but I think this should apply to all kinds of certificates in general.

I think there should be a way because it’s very intuitive in Windows. Also Chrome on macOS displays the full chain for websites. I think Keychain.app has this information because it labels the certificate as a verified one.

  • Are you trying to see a website certificate? Or any other certificate stored on your computer? – Prado Aug 29 '19 at 3:23
  • @Prado No, not a website certificate from browser. I want the one already in my Keychain.app. But if you have a way to view it with browser then that’s good solution, too. (I doubt it, though.) – Franklin Yu Aug 29 '19 at 3:24
  • To view it in browser, it needs to be a TLS certificate, instead of code-sign or S/MIME. In addition, the website needs to serve it; if the website renewed the certificate then this path is dead. – Franklin Yu Aug 29 '19 at 3:29
2

Evaluate Certificate

  1. Launch the Keychain Access.app
  2. Select the certificate of interest
  3. Select the menu item: Keychain Access (menu) > Certificate Assistant (sub-menu) > Evaluate "certificate name"…
  4. Select Continue to choose Generic evaulation (certificate chain validation only)
  5. Select Show Certificate… button

You can now navigate through the certificate chain and view the leaf, intermediate, and root certificate details.

enter image description here

enter image description here

2

For any Stored certificate, using Keychain Utility:

Open Keychain Utility, choose any certificate, double click it, select Detais:

enter image description here

The certificate will popup up, click on Details triangle.

enter image description here

Look for the issuer on the info below:

enter image description here

Here is the same certificate showed above, with the window extended to show full information: (NOTE: this osu.edu certificate is EXPIRED, so it is shown as "not trusted", but its issuer chain is present on it, and it is valid [the issuer InCommon CA chain].

enter image description here


Here is an Intermediate CA Certificate stored on my Keychain:

enter image description here

Here is another Intermediate CA Certificate

enter image description here


For any website certificate, using Safari:

enter image description here

After clicking "Show Certificate", folow the same procedure and click on the Details Triangle.

  • How can I jump from a leaf certificate to its intermediate CA certificate? That’s the whole point of my question. In your example, how can I see the certificate for “InCommon RSA Server CA” without going to the website? As I mentioned in question comment, the website may choose to serve a new certificate, so the last method won’t work in some cases. – Franklin Yu Aug 29 '19 at 4:19
  • If the certificate is stored on your Keychain, just scroll down the details window and you will find it on down almost at the botton, along with the Issuer and the URI of the InCommonRSAServerCA – Prado Aug 29 '19 at 4:28
  • Could you be more specific? I only see the certificate extensions at the bottom. Is it in the screenshots? – Franklin Yu Aug 29 '19 at 5:33
  • I extended the pictures to show all information of the certificates – Prado Aug 29 '19 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .