You can list the certificates in the key database to determine which certificate is the default certificate. In this example, the certificate named "example.com" is the default certificate.

Certificates found
* default, - personal, ! trusted, # secret key
* example.com
- bogus.com

The -getdefault option can be used to display details of the default certificate.

${install_root}/gsk8/bin/gsk8capicmd_64
-cert
-getdefault
-db /path/to/example.kdb
-stashed or -pw your_password

Something like this should be displayed.

Label : example.com
Key Size : 2048
Version : X509 V3
Serial : 170000005375983741e08058a201200000053
Issuer : CN=Acme,DC=acme,DC=corp
Subject : CN=Example,OU=IT,O=Acme,L=Guam,C=US
Not Before : March 9, 2017 10:08:28 AM CST

Not After : March 8, 2022 10:08:28 AM CST

Fingerprint : 
948abbd17939bb7c52cfe37c568bccad
02fedef0