Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

From my browser, I can browse to a machine in my companies local intranet and (after marking the certificate as trusted) export that certificate to a file. I'm trying to automate this process into a shellscript so I can make my life a little easier when using various commandline tools without throwing security out the window.

Trying to google this topic has been difficult and has mainly yielded results about how to trust a certificate you have already downloaded while using wget or curl, but that's not what I need in this case. How can I download the server's public self-signed certificate to a local file via wget or curl?

share|improve this question
    
BTW: Your company ought to generate its own CA, then use that to sign all its internal certificates. You then install only that CA's public key on your machine, not a self-signed cert for each server. –  derobert Jun 9 at 22:31
    
Thanks for the tip, I'll try to pass it along but those in charge may not care enough to actually do anything about it –  BCqrstoO Jun 9 at 22:57

1 Answer 1

up vote 3 down vote accepted

I'm not sure about wget or curl, but the following works if you are only concerned about the public key.

openssl s_client -connect hostname.domain.tld:port 2>&1 </dev/null | sed -ne '/BEGIN CERT/,/END CERT/p'

Generally when they are talking about downloading the certificate, it would be the root certificate. You can find the one for Verisign with the following command, then wget or curl the root cert on to your system to authenticate with Verisign certificates. In this case, it's specifically the "VeriSign Class 3 Extended Validation SSL SGC CA" Root.

$ openssl s_client -connect verisign.com:443 2>&1 </dev/null | openssl x509 -noout -text | grep "CA Issuers"
            CA Issuers - URI:http://EVIntl-aia.verisign.com/EVIntl2006.cer

The above command should work for nearly any server displaying a chained certificate.

share|improve this answer
    
That works perfectly. There is a small typo, sed is missing a - before the ne options but that works and is exactly what I need. Thank you. –  BCqrstoO Jun 9 at 22:30
    
Fixed the typo. It was correct in the latter one. Sorry about that, but glad it worked out in the end. –  Falsenames Jun 9 at 22:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.