Using openssl to get the certificate from a server

Question

I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my Java application.

A senior dev (who is on holidays :( ) informed me I can run this:

openssl s_client -connect host.host:9999

to get a raw certificate dumped out, which I can then copy and export. I receive the following output:

depth=1 /C=NZ/ST=Test State or Province/O=Organization Name/OU=Organizational Unit Name/CN=Test CA
verify error:num=19:self signed certificate in certificate chain
verify return:0
23177:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
23177:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

I have also tried it with this option:

-showcerts

and this one (running on Debian mind you):

-CApath /etc/ssl/certs/

But I get the same error.

This source says I can use that CApath flag but it doesn't seem to help. I tried multiple paths to no avail.

Please let me know where I'm going wrong.

score 524 · Answer 1 · edited Nov 03 '17 at 10:40

524

With SNI

If the remote server is using SNI (that is, sharing multiple SSL hosts on a single IP address) you will need to send the correct hostname in order to get the right certificate.

openssl s_client -showcerts -servername www.example.com -connect www.example.com:443 </dev/null

Without SNI

If the remote server is not using SNI, then you can skip -servername parameter:

openssl s_client -showcerts -connect www.example.com:443 </dev/null

To view the full details of a site's cert you can use this chain of commands as well:

$ echo | \
    openssl s_client -servername www.example.com -connect www.example.com:443 2>/dev/null | \
    openssl x509 -text

edited Nov 03 '17 at 10:40

Greg Dubicki

3,630
2
40
58

answered Oct 25 '11 at 07:54

Ari Maniatis

6,680
3
16
28

3

Hmm. I still get the same error when trying that command. I noticed my Openssl version is 'OpenSSL 0.9.8g 19 Oct 2007'. Do you have any ideas? – nasty pasty Oct 26 '11 at 02:07
42

Useful: `echo "" | openssl s_client -connect server:port -prexit 2>/dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p'` http://stackoverflow.com/a/12918442/843000 – mbrownnyc Jan 09 '13 at 20:31
20

Alternative useful script, from [madboa.com](http://www.madboa.com/geek/openssl/): `echo | openssl s_client -connect server:port 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cert.pem` – rmeakins Aug 05 '13 at 05:44
10

To make this a bit more concise, you can replace the `sed` with `openssl x509`, and read it in using a sub-shell: `openssl x509 -in /dev/null)` – Gabe Martin-Dempesy Aug 14 '13 at 17:28
31

Also `echo | openssl s_client -connect google.com:443 2>/dev/null | openssl x509` – MattSizzle Jan 15 '14 at 03:35
3

`echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -text` to get human readable output as well. Also as an [answer](http://stackoverflow.com/a/35442314/289064). – Florian Feb 16 '16 at 20:28
1

If you get a `write:errno=54` you may be communicating with a TLS1.2 only server using an older version of openssl (you need 1.0.1 or newer for TLS1.2). This happened to me on macOS 10.12 – Hbar Mar 23 '18 at 11:47
2

And if it is a Mailserver (SMTP) using starttls you want to get the certificate from, use: `openssl s_client -connect server:port -starttls smtp` – sdl Apr 18 '18 at 12:52
1

Since OpenSSL 1.1.1, SNI is enabled by default: "If -servername is not provided, the TLS SNI extension will be populated with the name given to -connect if it follows a DNS name format." – Alastair McCormack May 20 '20 at 11:00

score 71 · Answer 2 · edited Dec 27 '13 at 06:59

71

While I agree with Ari's answer (and upvoted it :), I needed to do an extra step to get it to work with Java on Windows (where it needed to be deployed):

openssl s_client -showcerts -connect www.example.com:443 < /dev/null | openssl x509 -outform DER > derp.der

Before adding the openssl x509 -outform DER conversion, I was getting an error from keytool on Windows complaining about the certificate's format. Importing the .der file worked fine.

edited Dec 27 '13 at 06:59

user314104

1,498
13
30

answered May 28 '13 at 16:53

David Jaquay

944
1
7
11

Odd. I've been using PEM certificates with keytool on Windows since Java 6 and never faced an issue. – imgx64 Nov 01 '17 at 05:19

score 61 · Answer 3 · answered Sep 28 '18 at 10:46

61

A one-liner to extract the certificate from a remote server in PEM format, this time using sed:

openssl s_client -connect www.google.com:443 2>/dev/null </dev/null |  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'

answered Sep 28 '18 at 10:46

André Fernandes

1,691
2
19
27

2

This one is almost perfect to extract the certificate, just missing the `-servername` option, don't know why, but I had to use it to get the full certificate. – Karl.S Mar 29 '19 at 23:51
-servername is required for server name indication (SNI). Web searching can expand on the rest. – Sam Gleske Jun 06 '20 at 18:17

score 41 · Accepted Answer · edited Feb 06 '16 at 16:28

41

It turns out there is more complexity here: I needed to provide many more details to get this rolling. I think its something to do with the fact that its a connection that needs client authentication, and the hankshake needed more info to continue to the stage where the certificates were dumped.

Here is my working command:

openssl s_client -connect host:port -key our_private_key.pem -showcerts \
                 -cert our_server-signed_cert.pem

Hopefully this is a nudge in the right direction for anyone who could do with some more info.

edited Feb 06 '16 at 16:28

chown

48,838
16
128
167

answered Oct 27 '11 at 01:43

nasty pasty

5,486
7
22
26

6

I am sorry, but your answer doesn't make much sense. You needed to pass the certificate to the server in order to get the certificate? – Ari Maniatis Nov 14 '11 at 22:12
2

Yep. Client authentication AFAIK. – nasty pasty Nov 15 '11 at 02:34
11

It turns out '-prexit' will return that data as well. E.g.; openssl s_client -connect host:port -prexit – Robert Sep 20 '12 at 12:54

score 35 · Answer 5 · edited Aug 22 '16 at 11:59

35

The easiest command line for this, which includes the PEM output to add it to the keystore, as well as a human readable output and also supports SNI, which is important if you are working with an HTTP server is:

openssl s_client -servername example.com -connect example.com:443 \
    </dev/null 2>/dev/null | openssl x509 -text

The -servername option is to enable SNI support and the openssl x509 -text prints the certificate in human readable format.

edited Aug 22 '16 at 11:59

slm

12,534
12
87
106

answered Feb 16 '16 at 20:26

Florian

2,803
1
24
26

You may add to your -servername your subdomain, for instance ws.example.com instead of example.com (apply this to the -connect parameter too). – russellhoff Jan 26 '17 at 11:26

kenorb · Answer 6 · 2016-03-25T12:11:34.007

To get the certificate of remote server you can use openssl tool and you can find it between BEGIN CERTIFICATE and END CERTIFICATE which you need to copy and paste into your certificate file (CRT).

Here is the command demonstrating it:

ex +'/BEGIN CERTIFICATE/,/END CERTIFICATE/p' <(echo | openssl s_client -showcerts -connect example.com:443) -scq > file.crt

To return all certificates from the chain, just add g (global) like:

ex +'g/BEGIN CERTIFICATE/,/END CERTIFICATE/p' <(echo | openssl s_client -showcerts -connect example.com:443) -scq

Then you can simply import your certificate file (file.crt) into your keychain and make it trusted, so Java shouldn't complain.

On OS X you can double-click on the file or drag and drop in your Keychain Access, so it'll appear in login/Certificates. Then double-click on the imported certificated and make it Always Trust for SSL.

On CentOS 5 you can append them into /etc/pki/tls/certs/ca-bundle.crt file (and run: sudo update-ca-trust force-enable), or in CentOS 6 copy them into /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust extract.

In Ubuntu, copy them into /usr/local/share/ca-certificates and run sudo update-ca-certificates.

score 13 · Answer 7 · answered Oct 25 '17 at 01:09

13

HOST=gmail-pop.l.google.com
PORT=995

openssl s_client -servername $HOST -connect $HOST:$PORT < /dev/null 2>/dev/null | openssl x509 -outform pem

answered Oct 25 '17 at 01:09

akond

14,891
4
32
54

score 6 · Answer 8 · edited Apr 24 '18 at 17:29

to print only the certificate chain and not the server's certificate:

# MYHOST=myhost.com
# MYPORT=443
# openssl s_client -connect ${MYHOST}:${MYPORT} -showcerts 2>/dev/null </dev/null | awk '/^.*'"${MYHOST}"'/,/-----END CERTIFICATE-----/{next;}/-----BEGIN/,/-----END CERTIFICATE-----/{print}'

to update CA trust on CentOS/RHEL 6/7 :

# update-ca-trust enable
# openssl s_client -connect ${MYHOST}:${MYPORT} -showcerts 2>/dev/null </dev/null | awk '/^.*'"${MYHOST}"'/,/-----END CERTIFICATE-----/{next;}/-----BEGIN/,/-----END CERTIFICATE-----/{print}' >/etc/pki/ca-trust/source/anchors/myca.cert
# update-ca-trust extract

on CentOS/RHEL 5:

# openssl s_client -connect ${MYHOST}:${MYPORT} -showcerts 2>/dev/null </dev/null | awk '/^.*'"${MYHOST}"'/,/-----END CERTIFICATE-----/{next;}/-----BEGIN/,/-----END CERTIFICATE-----/{print}' >>/etc/pki/tls/certs/ca-bundle.crt

Exactly what I needed on CentOS7. Thanks! – Arthur Hebert-Ryan Dec 04 '19 at 20:35 — Arthur Hebert-Ryan, Dec 04 '19 at 20:35

score 5 · Answer 9 · answered Jun 30 '17 at 11:39

You can get and store the server root certificate using next bash script:

CERTS=$(echo -n | openssl s_client -connect $HOST_NAME:$PORT -showcerts | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p')
echo "$CERTS" | awk -v RS="-----BEGIN CERTIFICATE-----" 'NR > 1 { printf RS $0 > "'$SERVER_ROOT_CERTIFICATE'"; close("'$SERVER_ROOT_CERTIFICATE'") }'

Just overwrite required variables.

score 5 · Answer 10 · answered Jul 23 '19 at 20:34

If your server is an email server (MS Exchange or Zimbra) maybe you need to add the starttls and smtp flags:

openssl s_client -starttls smtp -connect HOST_EMAIL:SECURE_PORT 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > CERTIFICATE_NAME.pem

Where,

HOST_EMAIL is the server domain, for example, mail-server.com.
SECURE_PORT is the communication port, for example, 587 or 465
CERTIFICATE_NAME output's filename (BASE 64/PEM Format)

score 2 · Answer 11 · edited Apr 13 '17 at 12:13

2

For the benefit of others like me who tried to follow the good advice here when accessing AWS CloudFront but failed, the trick is to add -servername domain.name...

Source: https://serverfault.com/a/780450/8972

edited Apr 13 '17 at 12:13

Community

1
1

answered Jan 05 '17 at 04:26

Amos Shapira

3,540
5
27
33

Using openssl to get the certificate from a server

11 Answers11

With SNI

Without SNI

Linked