I don't think there is functionality exactly what you are asking for.

You could determine what certificate your queue manager should be using by looking at the certificate label set in the QMGR CERTLABL setting and then using that in openssl/gsk commands to query the keystore. For example:

In MQSC:

DISPLAY QMGR CERTLABL

on the command line:

runmqakm -cert -details -db <keystore> -stashed -label <label from above>

However, that will show the certificate in the keystore and if you've started TLS connections and then modified the keystore contents you could potentially have a difference between what the keystore contains and what MQ is currently using. The above also doesn't take into account different certificates being used on a per-channel basis.

You could use openssl to query the queue manager listener which would return the certificate it is using by connecting to the queue manager. This will cause an error because MQ won't understand why openssl just connected to it and then instantly disconnected:

openssl s_client -connect <host>:<port> -showcerts

This should give a lot of information about the certificate currently in use. If you want to query a certificate in use by a particular channel then you would need to work out the correct SNI to send using this documentation page: https://www.ibm.com/support/pages/ibm-websphere-mq-how-does-mq-provide-multiple-certificates-certlabl-capability

If these don't meet your needs of having a MQ command you can run to print out the certificate details currently in use without querying the keystore on the disk then i would encourage you to raise a feature request with the IBM MQ team: https://www.ibm.com/developerworks/rfe/execute?use_case=changeRequestLanding&PROD_ID=520