Reference

pki---dn(1) on Linux

The text 7921cbe5cf69, as Debian 9 (Stretch) shipped it.

Extract the subject DN of an X.509 certificate

Flags it lists

pki---dn(1) on Linux now