I need to download a SSL cert in PEM format from a HTTPS website, https://api.paczkomaty.pl . So I am using OpenSSL to do that:

openssl s_client -connect api.paczkomaty.pl:443 > myfile
openssl x509 -in myfile -text 

Here's the result:

        Version: 3 (0x2)
        Serial Number:
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA
            Not Before: Mar 11 00:00:00 2017 GMT
            Not After : Apr 10 23:59:59 2018 GMT
        Subject: CN = *.grupainteger.pl

However, when I visit the website via a browser (Chrome or Firefox) and inspect its certificate, it shows me a different one; its Serial Number is different, and its validity is from 15/1/2018 to 1/9/2018.

Why is OpenSSL fetching a different certificate?


Why is OpenSSL fetching a different certificate?

s_client by default does not send SNI (Server Name Indication) data but a browser does. The server may choose to respond with a different certificate based on the contents of that SNI - or if no SNI is present then it will serve a default certificate. Try adding -servername api.paczkomaty.pl to your s_client command line

  • Yes, this worked. I find surprising that OpenSSL does not do this by default. – dr01 Feb 5 '18 at 10:45
  • 1
    It does this by default in the latest dev versions (1.1.1), but not in current stable versions. – Matt Caswell Feb 5 '18 at 13:52

Multiple SSL/TLS sites on the same physical server, using TLS SNI (Server Name Indication). If the client does not provide SNI information (OpenSSL s_client won't unless told to), some fall-back default site certificate gets used.

Add the -servername option to your openssl s_client command like this:

openssl s_client -servername api.paczkomaty.pl -connect api.paczkomaty.pl:443 > myfile

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.