Get Certificate Chain From Server using OpenSSL

Securing communication over the internet is crucial in today's digital age, and one fundamental aspect of this security is the use of SSL/TLS certificates. One common task is obtaining the certificate chain from a server, which includes the server's certificate along with any intermediate certificates in the chain. This information can be vital for troubleshooting, verifying the authenticity of a server, or ensuring that your own server's certificate is correctly configured. This tutorial shows how to get certificate chain from server using OpenSSL.

To retrieve the certificate chain from a server, we can use the openssl s_client command. The following command connects to the Google server on port 443 and displays the certificate chain:

echo | openssl s_client -showcerts -connect www.google.com:443

Let's break down the components of this command:

• echo - is used to provide an empty input to close the input stream. It ensures that the openssl s_client command doesn't wait for user input during the SSL/TLS handshake process.
• -showcerts - instructs to display the full server certificate chain.
• -connect - specifies the server and port to connect to. Note: 443 is the standard port for HTTPS.

An example of part of the output:

CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = www.google.com
verify return:1
---
Certificate chain
 0 s:CN = www.google.com
   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: RSA-SHA256
   v:NotBefore: Nov 20 08:09:47 2023 GMT; NotAfter: Feb 12 08:09:46 2024 GMT
-----BEGIN CERTIFICATE-----
MIIEhjCCA26gAwIBAgIQMSLF87fiqdsJ4To3xUynTTANBgkqhkiG9w0BAQsFADBG
MQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExM
...