Find out if a certificate is self-signed or CA-signed

Edit: There are two better answers to this question today:

• https://stackoverflow.com/a/57927684/377270
• https://stackoverflow.com/a/14515875/377270

However, I think there are more important things to address - why do people want to know about self-signed certificates. What is the goal? What's the problem? In most cases, trying to separate certificates into self-signed and non-self-signed piles is probably the wrong approach. A better approach is almost certainly to verify that any given certificate has a valid signature chain from a trusted certificate authority and that any connections associated with the given certificate match that certificate.

Here is the rest of my original answer. This is probably not what you want.

It's a bit hacky, but the openssl x509command can report publishers and topics. If the subject and issuer are the same, it is self-signed; if they are different, it is signed by the CA. (Strictly speaking, many self-signed certificates are also signed by the CA itself.)

While testing this theory, I ran some tests. It runs something like:

cd /etc/ssl/certs
for f in *.0 ; do openssl x509 -in $f -issuer | head -1 > /tmp/$f.issuer ; openssl x509 -in $f -subject | head -1 > /tmp/$f.subject ; done
 cd /tmp
 sed -i -e s/issuer=// *.issuer
 sed -i -e s/subject=// *.subject
 cd /etc/ssl/certs/
 for f in *.0 ; do diff -u /tmp/$f.issuer /tmp/$f.subject ; done

Hope this helps.