From below command able to generate Base64 pin for only first depth certificate. But need to generate pin for all depth of certificate.

openssl s_client -servername example.com -connect example.com:443 -showcerts 
| openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

Gives only one key instead of three,


So, how can we generate all three level of pins?


Although I mostly concur with Romeo that you should have the cert files on the server already, if you do need to process the multiple certs from one s_client you can do something like:

 openssl s_client ..... -showcerts \
   | awk '/-----BEGIN/{f="cert."(n++)} f{print>f} /-----END/{f=""}'
 # or input from bundle or chain file
 for c in cert.*; do
   openssl x509 <$c -noout -pubkey .....
 rm cert.* 
 # use better temp name/location if you want
  • Nice answer. I hope I remember its location to cite it in the future. – user56041 Jun 14 '17 at 13:20

You can extract the issuer from the certificate (CN of issuer). But from this point you should get this certificate by hand, searching on the issuer web site. If you have access to the web server you will find in filesystem the certificates and run your script over the file(s) with CA certificates

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.