OpenSSL -nameopt option
There is an interesting option when using OpenSSL to get certificate information that is called -nameopt. It can produce different output. It can also be a source of bugs since the default format as changed from compat (compatibility) to oneline. There is a subtle difference that can be lead to mistake if the output is parsed.
openssl x509 -noout -subject -nameopt compat -in cacert.pem
# subject=/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
openssl x509 -noout -subject -nameopt oneline -in cacert.pem
# subject=C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
But there is also and additional multiline possibility that is convenient for humans but also to grep fields.
openssl x509 -noout -subject -nameopt multiline -in cacert.pem
# subject=
# countryName = BE
# organizationName = GlobalSign nv-sa
# organizationalUnitName = Root CA
# commonName = GlobalSign Root CA