Openssl

When dealing with "SSL" (or more appropriately TLS) certificates, you'll encounter .pem .crt .cer .key .der files. So, what's the difference?

There are four basic types of certificate manipulations. View, Transform, Combination , and Extraction

.der encoded certificates are binary, so to view them, you use a slightly modified command: openssl x509 -in mycert.der -inform der -text -noout

View a Certificate

openssl x509 -in /etc/haproxy/certs/wiki.freephile.org.pem -text -noout

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:10:47:5a:ec:82:08:e3:ec:30:7e:dc:dc:45:a7:93:8e:62
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
        Validity
            Not Before: Apr 24 13:29:01 2018 GMT
            Not After : Jul 23 13:29:01 2018 GMT
        Subject: CN=wiki.freephile.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b5:b3:aa:e4:59:5b:3e:dd:1f:b4:85:83:f0:41:
                    82:7e:85:df:7f:ae:32:44:1f:2e:e4:0d:05:4b:73:
                    0f:39:e2:5b:7e:f7:f5:3c:64:c2:fe:6e:fe:4c:e3:
                    73:62:bc:89:7e:8c:4b:0e:b6:66:e1:c2:e0:a7:d8:
                    d5:af:14:51:de:62:73:34:6b:be:07:0f:c3:78:dd:
                    6a:c6:91:ad:3d:d7:8d:1f:61:26:3d:6c:1d:41:b1:
                    e0:7c:d4:87:4a:f7:29:35:43:ac:e9:47:19:f7:d3:
                    4e:5d:91:4b:1b:62:f5:49:71:fd:b8:e8:86:ae:35:
                    07:27:3d:60:44:c4:c8:76:f7:1a:d7:e3:1c:d4:a3:
                    8a:1e:66:68:d6:78:2f:6e:7b:43:30:09:4a:78:57:
                    32:10:1c:c7:01:69:2a:3a:18:ad:b5:bb:7a:3e:6e:
                    0c:24:4e:27:42:a7:87:31:20:0f:b8:d5:06:b1:f1:
                    8a:cd:48:47:88:9e:50:12:ec:a1:59:d7:6d:12:cf:
                    8e:6b:da:aa:59:4a:46:5f:b6:d1:19:72:1d:ee:c1:
                    88:eb:6b:a2:2e:e4:d3:81:90:4c:9f:f1:06:56:43:
                    a4:7d:07:a7:03:c7:3b:3d:85:a8:39:9a:cf:c6:2c:
                    ac:54:07:9d:65:c7:19:39:e8:73:2d:e5:f9:eb:f7:
                    c3:af
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                CE:85:E6:59:F4:D5:75:F8:C0:2A:35:4C:6F:5E:81:C3:C3:74:97:C9
            X509v3 Authority Key Identifier: 
                keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1

            Authority Information Access: 
                OCSP - URI:http://ocsp.int-x3.letsencrypt.org
                CA Issuers - URI:http://cert.int-x3.letsencrypt.org/

            X509v3 Subject Alternative Name: 
                DNS:meta.qualitybox.us, DNS:wiki.freephile.org
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.44947.1.1.1
                  CPS: http://cps.letsencrypt.org
                  User Notice:
                    Explicit Text: This Certificate may only be relied upon by Relying Parties and only in accordance with the Certificate Policy found at https://letsencrypt.org/repository/

            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : DB:74:AF:EE:CB:29:EC:B1:FE:CA:3E:71:6D:2C:E5:B9:
                                AA:BB:36:F7:84:71:83:C7:5D:9D:4F:37:B6:1F:BF:64
                    Timestamp : Apr 24 14:29:01.244 2018 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:2D:74:0F:F3:8F:87:D9:40:92:2B:43:C7:
                                A8:FE:77:87:D6:86:26:B4:AD:76:28:46:DA:AA:84:E9:
                                59:C5:F5:68:02:20:55:BE:CC:46:BC:85:40:8C:B4:BD:
                                2C:53:04:06:88:5B:93:34:10:A3:6D:B9:D9:59:4E:5C:
                                63:FC:FA:EC:64:4B
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : 29:3C:51:96:54:C8:39:65:BA:AA:50:FC:58:07:D4:B7:
                                6F:BF:58:7A:29:72:DC:A4:C3:0C:F4:E5:45:47:F4:78
                    Timestamp : Apr 24 14:29:01.274 2018 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:27:6A:87:41:B2:05:76:33:03:FD:8C:25:
                                FD:0A:18:4D:2B:74:FE:33:D3:43:66:33:A1:33:91:85:
                                2B:45:44:B6:02:21:00:DA:0A:CC:4F:C3:CF:EE:53:8C:
                                4C:B8:8B:64:40:39:C9:3F:13:2D:D1:44:22:CC:E1:B6:
                                B6:C1:3F:3F:D4:23:39
    Signature Algorithm: sha256WithRSAEncryption
         96:14:50:89:03:22:c4:48:0f:1a:25:55:4a:26:70:3e:28:3b:
         86:58:60:08:d1:ce:bf:01:d6:53:72:bf:b2:fc:90:6f:62:74:
         ae:a5:7b:a1:77:77:6f:c4:96:41:0a:7a:92:e2:ba:8c:4e:38:
         f0:e2:b5:fb:5e:62:db:fb:b8:a9:66:25:cf:af:5c:c5:d9:0c:
         5e:c8:8d:f5:69:a3:32:2a:58:0e:30:1c:ca:60:3b:54:12:56:
         71:d9:b2:fc:c2:55:a6:cf:6f:61:af:79:60:85:29:37:9f:80:
         eb:da:26:a0:5a:38:55:41:bd:16:92:03:7e:b9:a3:8b:ef:47:
         4e:86:1f:bf:11:85:35:0f:99:58:4c:d8:9d:c0:59:72:bc:cf:
         d7:6d:75:96:e8:94:21:0d:43:38:ab:b1:e9:1a:90:f2:d9:24:
         da:93:e0:cd:8f:d4:69:d1:9b:1e:c1:60:b0:c8:fa:aa:11:2e:
         36:49:92:b3:9f:df:9a:91:43:41:4f:1f:d0:49:c5:17:ce:ac:
         a6:4b:13:9d:cb:a7:f0:59:32:72:81:a0:5a:07:72:fb:93:72:
         57:11:d8:eb:61:3e:34:09:38:e9:41:a8:d3:d9:59:ee:e9:c5:
         4b:c5:3f:9b:4e:94:ef:eb:72:21:a0:40:c3:5b:65:26:61:ec:
         25:02:52:01