Get Certificate Chain From Server using OpenSSL

Get Certificate Chain From Server using OpenSSL

Securing communication over the internet is crucial in today's digital age, and one fundamental aspect of this security is the use of SSL/TLS certificates. One common task is obtaining the certificate chain from a server, which includes the server's certificate along with any intermediate certificates in the chain. This information can be vital for troubleshooting, verifying the authenticity of a server, or ensuring that your own server's certificate is correctly configured. This tutorial shows how to get certificate chain from server using OpenSSL.

To retrieve the certificate chain from a server, we can use the openssl s_client command. The following command connects to the Google server on port 443 and displays the certificate chain:

echo | openssl s_client -showcerts -connect www.google.com:443

Let's break down the components of this command:

  • echo - is used to provide an empty input to close the input stream. It ensures that the openssl s_client command doesn't wait for user input during the SSL/TLS handshake process.
  • -showcerts - instructs to display the full server certificate chain.
  • -connect - specifies the server and port to connect to. Note: 443 is the standard port for HTTPS.

An example of part of the output:

CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = www.google.com
verify return:1
---
Certificate chain
 0 s:CN = www.google.com
   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: RSA-SHA256
   v:NotBefore: Nov 20 08:09:47 2023 GMT; NotAfter: Feb 12 08:09:46 2024 GMT
-----BEGIN CERTIFICATE-----
MIIEhjCCA26gAwIBAgIQMSLF87fiqdsJ4To3xUynTTANBgkqhkiG9w0BAQsFADBG
MQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExM
...

Leave a Comment

Cancel reply

Your email address will not be published.