2

From my browser, I can browse to a machine in my companies local intranet and (after marking the certificate as trusted) export that certificate to a file. I'm trying to automate this process into a shellscript so I can make my life a little easier when using various commandline tools without throwing security out the window.

Trying to google this topic has been difficult and has mainly yielded results about how to trust a certificate you have already downloaded while using wget or curl, but that's not what I need in this case. How can I download the server's public self-signed certificate to a local file via wget or curl?

Improve this question
2
  • BTW: Your company ought to generate its own CA, then use that to sign all its internal certificates. You then install only that CA's public key on your machine, not a self-signed cert for each server.
    – derobert
    Commented Jun 9, 2014 at 22:31
  • Thanks for the tip, I'll try to pass it along but those in charge may not care enough to actually do anything about it
    – Niko
    Commented Jun 9, 2014 at 22:57

1 Answer 1

Reset to default
4

I'm not sure about wget or curl, but the following works if you are only concerned about the public key.

openssl s_client -connect hostname.domain.tld:port 2>&1 </dev/null | sed -ne '/BEGIN CERT/,/END CERT/p'

Generally when they are talking about downloading the certificate, it would be the root certificate. You can find the one for Verisign with the following command, then wget or curl the root cert on to your system to authenticate with Verisign certificates. In this case, it's specifically the "VeriSign Class 3 Extended Validation SSL SGC CA" Root.

$ openssl s_client -connect verisign.com:443 2>&1 </dev/null | openssl x509 -noout -text | grep "CA Issuers"
            CA Issuers - URI:http://EVIntl-aia.verisign.com/EVIntl2006.cer

The above command should work for nearly any server displaying a chained certificate.

Improve this answer
2
  • That works perfectly. There is a small typo, sed is missing a - before the ne options but that works and is exactly what I need. Thank you.
    – Niko
    Commented Jun 9, 2014 at 22:30
  • Fixed the typo. It was correct in the latter one. Sorry about that, but glad it worked out in the end.
    – Falsenames
    Commented Jun 9, 2014 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .