I have an end-entity/server certificate which have an intermediate and root certificate. When I cat on the end-entity certificate, I see only a single BEGIN and END tag. It is the only the end-entity certificate.

Is there any way I can view the intermediate and root certificate content. I need only the content of BEGIN and END tag.

In Windows I can see the full cert chain from the "Certification Path". Below is the example for the Stack Exchange's certificate.

enter image description here

From there I can perform a View Certificate and export them. I can do that for both root and intermediate in Windows. I am looking for this same method in Linux.

enter image description here

  • 1
    Please do tell us who issued you that cert. – Rui F Ribeiro May 30 '17 at 15:15
  • @RuiFRibeiro Let's say anyone... I want to see the cert chain for stackexchange with only the primary certificate in hand. – Anirban Nag 'tintinmj' May 30 '17 at 15:57

From a web site, you can do:

openssl s_client -showcerts -verify 5 -connect stackexchange.com:443 < /dev/null

That will show the certificate chain and all the certificates the server presented.

Now, if I save those two certificates to files, I can use openssl verify:

$ openssl verify -show_chain -untrusted dc-sha2.crt se.crt 
se.crt: OK
depth=0: C = US, ST = NY, L = New York, O = "Stack Exchange, Inc.", CN = *.stackexchange.com (untrusted)
depth=1: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA (untrusted)
depth=2: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA

The -untrusted option is used to give the intermediate certificate(s); se.crt is the certificate to verify. The depth=2 result came from the system trusted CA store.

If you don't have the intermediate certificate(s), you can't perform the verify. That's just how X.509 works.

Depending on the certificate, it may contain a URI to get the intermediate from. As an example, openssl x509 -in se.crt -noout -text contains:

        Authority Information Access: 
            OCSP - URI:http://ocsp.digicert.com
            CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt

That "CA Issuers" URI points to the intermediate cert (in DER format, so you need to use openssl x509 -inform der -in DigiCertSHA2HighAssuranceServerCA.crt -out DigiCertSHA2HighAssuranceServerCA.pem to convert it for further use by OpenSSL).

If you run openssl x509 -in /tmp/DigiCertSHA2HighAssuranceServerCA.pem -noout -issuer_hash you get 244b5494, which you can look for in the system root CA store at /etc/ssl/certs/244b5494.0 (just append .0 to the name).

I don't think there is a nice, easy OpenSSL command to do all that for you.

  • That's the main problem. I don't have the URL with me. I only have the certificate file. And I need the encrypted content between BEGIN and END tag (which you will get after just cating the .crt file. – Anirban Nag 'tintinmj' May 30 '17 at 18:56
  • @AnirbanNag'tintinmj' If you're just looking to decode the certificate, try openssl x509 -in file.crt -noout -text – derobert May 30 '17 at 19:25
  • I want the content of intermediate at root cert which is between the BEGIN and END tag. – Anirban Nag 'tintinmj' May 30 '17 at 19:29
  • Or if you can give a command which will extract the intermediate and root cert from the primary cert and save that into a file... I can live with that too. – Anirban Nag 'tintinmj' May 30 '17 at 19:30
  • @AnirbanNag'tintinmj' If it's not showing up with the openssl x509 command, I don't think the intermediate certificate is there. (Unless you got some error from openssl x509). – derobert May 30 '17 at 19:41

tl;dr - one liner bash magic to dump all certs in the chain

openssl s_client -showcerts -verify 5 -connect wikipedia.org:443 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".pem"; print >out}'; for cert in *.pem; do newname=$(openssl x509 -noout -subject -in $cert | sed -nE 's/.*CN ?= ?(.*)/\1/; s/[ ,.*]/_/g; s/__/_/g; s/_-_/-/; s/^_//g;p' | tr '[:upper:]' '[:lower:]').pem; echo "${newname}"; mv "${cert}" "${newname}"; done

Explanation in 2 steps

To dump all certs in the chain to the current dir as cert${chain_number}.pem:

openssl s_client -showcerts -verify 5 -connect your_host:443 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".pem"; print >out}' 

The bonus-track to rename them to their common name:

for cert in *.pem; do newname=$(openssl x509 -noout -subject -in $cert | sed -nE 's/.*CN ?= ?(.*)/\1/; s/[ ,.*]/_/g; s/__/_/g; s/_-_/-/; s/^_//g;p' | tr '[:upper:]' '[:lower:]').pem; mv $cert $newname; done
  • Is there any reason to choose ".pem" versus ".crt" as the extension since you're only renaming them, not changing the format? – Captain Man Feb 5 '19 at 21:23
  • 1
    No, not really. ".pem" is the format (base64 of the DER) ".crt" means it's a certificate but doesn't tell anything about the encoding. I was about to make it more consistent and name all pem... But I think is simpler to read in the one liner to understand where the certificate is getting downloaded (crt) and finish what I typically use in the Linux world (pem). Hope this clarifies things a bit... – estani Feb 6 '19 at 23:16
  • 1
    Yes it does, I realize PEM is a format but I often see crt and wasn't sure if it was a format. This actually helps explain why I see "crt" used so often. Thanks :) – Captain Man Feb 7 '19 at 16:59
  • This seems to only work if you already trust the source. I'm trying to download a custom CA but it's only downloading the first certificate, not the chain. – mjaggard Jul 5 '19 at 8:37
  • @mjaggard strange since I used it exactly for that case. That being said, the server might not be sending the root CA at all, if you take a look at my example, it used to download 3 certs now it's downloading only 2. I assume wikipedia server is not sending the root (there's really no point, if you don't have it, you won't trust it anyways...). I'm pretty sure it wasn't the case before. – estani Jul 5 '19 at 9:36

I found out that with the option -verify 5 openssl is going deep in the chain showing all the cert, even that not included in your certificate deployment.

If you really want to understand which chain is provided with your certificate you should run:

openssl s_client -showcerts -partial_chain -connect YOUR_ENDPOINT:443 < /dev/null |less

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.