Using openssl to get the certificate from a server

How to Use OpenSSL to Get the Certificate from a Server 📜💻

So, you want to fetch the certificate of a remote server and utilize it within your Java application? No problem! OpenSSL can come to your rescue. 🦸‍♂️

OpenSSL is a powerful command-line tool that is widely used for SSL/TLS-related tasks. In this guide, we will walk you through the process of using OpenSSL to obtain the certificate from a server. 📝

The Command to Fetch the Certificate

To get started, open your command line interface (CLI) and run the following command:

openssl s_client -connect host.host:9999

Replace host.host:9999 with the actual hostname and port number of the server you want to connect to. This command establishes a connection with the server and fetches the raw certificate. 🌐

Common Issue: Self-Signed Certificate Error 😬

When you run the above command, you might encounter the following error:

depth=1 /C=NZ/ST=Test State or Province/O=Organization Name/OU=Organizational Unit Name/CN=Test CA
verify error:num=19:self signed certificate in certificate chain
verify return:0
23177:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
23177:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

This error indicates that the certificate presented by the server is self-signed, meaning it hasn't been signed by a trusted certificate authority (CA). By default, OpenSSL tries to validate the certificate chain, which fails in the case of self-signed certificates. 😱

Easy Solution: Skipping Certificate Validation 🙈

To overcome the self-signed certificate error, you can add the -no_ssl3 flag to the command like this:

openssl s_client -connect host.host:9999 -no_ssl3

Adding the -no_ssl3 flag tells OpenSSL to skip the SSLv3 handshake, which includes the certificate validation step. This allows you to fetch the certificate of the server without encountering the self-signed certificate error. 😌

Additional Options for More Information ℹ️

If you want to retrieve additional information about the certificate, you can make use of the -showcerts option. This option will display the entire certificate chain, including the server certificate and any intermediate certificates.

openssl s_client -connect host.host:9999 -showcerts

Furthermore, if you are running OpenSSL on Debian, you can specify the CA database path using the -CApath option. The CA database provides trusted root certificates for certificate validation. Here's an example:

openssl s_client -connect host.host:9999 -CApath /etc/ssl/certs/

Note that the above path (/etc/ssl/certs/) is the default CA database path in Debian, but you may need to adjust it depending on your system configuration. 🗺️

Call-to-Action: Share Your Experience and Ask Questions! 🗣️💬

Now that you know how to use OpenSSL to fetch a server's certificate, give it a try and let us know how it goes! If you encounter any issues or have further questions, drop a comment below. We'd love to hear about your experience and assist you in any way possible. Happy coding! 😄🚀