I frequently use the OpenConnect plugin for NetworkManager to access VPN resources. However, each time I activate the VPN profile it asks me if I would like to accept the certificate. Is there a way to pull the remote VPN certificate so I can persistently put it in my trusted certificate store?

I am using nm-applet to do all of this from a nice tray icon, but the command-line equivalent also requests that I accept the certificate.

tldr; How can you requests certificates?


As openconnect/anyconnect are ssl based, you might try openssl:

: | openssl s_client -connect example.com:443 -prexit 2>/dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p'

the first certificate returned would be the servers, the last certificate would be the ca certificate. you could then copy them to /etc/ssl/certs/ (or similar on arch).

(credits for the command go to: https://stackoverflow.com/questions/7885785/using-openssl-to-get-the-certificate-from-a-server#comment19766982_7886248 )

  • Perfect. That was exactly what I needed. – sherrellbc Aug 19 '16 at 15:58
  • 1
    It's more elegant to replace echo "" with :. – reinierpost Mar 22 '18 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.