Introduction
When developing applications that require secure communication over HTTPS, understanding how to retrieve and manage server certificates is crucial. This tutorial provides a comprehensive guide on using OpenSSL—a powerful toolkit for SSL/TLS—to extract certificates from remote servers. Whether you’re adding them to your keystore or verifying server identities, mastering these techniques is essential.
Understanding OpenSSL
OpenSSL is an open-source software library implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It provides command-line tools for a variety of cryptographic operations including certificate generation, encryption, and connection testing.
Basic Syntax
The openssl s_client tool allows you to initiate a secure connection to a remote server and retrieve information about its SSL/TLS setup. Here’s the basic syntax:
openssl s_client -connect [hostname]:[port]
This command connects to the specified host and port, displaying details of the SSL handshake process.
Retrieving Certificates with SNI
Server Name Indication (SNI) is a TLS extension that allows multiple domains to share a single IP address. When dealing with servers using SNI, you must specify the hostname during your OpenSSL command:
openssl s_client -showcerts -servername [hostname] -connect [hostname]:[port]
The -servername option ensures the server presents the certificate corresponding to the specified host.
Handling Common Errors
-
Host Not Found Error: If you encounter an error related to hostname resolution, try executing without
wwwin the domain name.openssl s_client -showcerts -connect example.com:443 -
Secure Renegotiation Warnings: Sometimes a corporate firewall may block secure renegotiations. In such cases, you might use
-legacy_renegotiation, but be cautious as it reduces security.
Without SNI
For servers that do not support SNI, simply omit the -servername option:
openssl s_client -showcerts -connect [hostname]:[port]
This command will retrieve the default certificate presented by the server.
Extracting Certificates in PEM Format
To extract and display certificates in a human-readable PEM format, use the following command:
echo | openssl s_client -servername [hostname] -connect [hostname]:443 2>/dev/null | openssl x509 -text
This sequence extracts the certificate chain and outputs it in plain text.
Extracting Certificates Using Sed
For extracting certificates directly to PEM format, sed can be used as follows:
openssl s_client -connect [hostname]:443 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
This command pipes the output and uses sed to filter only the certificate sections.
Converting Certificates to DER Format
When working with Java applications, especially on Windows, certificates might need conversion to DER format:
openssl s_client -showcerts -connect [hostname]:443 </dev/null | openssl x509 -outform DER > cert.der
This command converts the PEM certificate into a binary DER file suitable for use in certain Java environments.
Advanced Connection Scenarios
In cases where client authentication is required, additional details may be necessary:
openssl s_client -connect [hostname]:[port] -key [private_key.pem] -cert [signed_cert.pem]
This command provides the needed credentials to establish a connection when mutual TLS (mTLS) is used.
Conclusion
Retrieving server certificates using OpenSSL is an essential skill for developers dealing with secure communications. This tutorial covered retrieving certificates with and without SNI, converting formats, and handling advanced scenarios like client authentication. By following these guidelines, you can effectively manage SSL/TLS configurations in your projects.