1

I have this shell code that reads lines of host names from input file, performs an openssl command to print ssl certificate info, and outputs the results in the terminal.

while read x; 
do
echo $x;
echo | openssl s_client -servername "$x" -connect "$x":443 -CApath etc/ssl/certs/ca-certificates.crt 2>/dev/null;
done <mylist.txt

This is an example output:

example.com
CONNECTED(00000003)
---
Certificate chain
 0 s:/CN=*.vhs.ir
   i:/CN=*.vhs.ir
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIC8jCCAdqgAwIBAgIFAgK8lFowDQYJKoZIhvcNAQELBQAwEzERMA8GA1UEAwwI
Ki52aHMuaXIwHhcNMTcwMjA5MTIzMDUwWhcNMTgwMjA5MTIzMDUwWjATMREwDwYD
VQQDDAgqLnZocy5pcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANvD
aCQtMdGEPLpLAQGrnEpWjWHxolB71dYVXSBCBVAhjeCCBYtRnZSWFZRpNyskBHFc
eUoGRc5FkZgetujWgBjvQrufug1gyzvcENZkmRcjnjRNDLguzkZDJNjRcm4gik47
1Q1eGD6oF50clDH5XyeLtedk+0buYGS5HvVWX4lNKn1bMWpeqU20paLa8G4eqV4z
vNdE534rl9lYKMltD+y+/h+rhZ0Lq2Na+2P2a37NvOg67kkQbIl/SQticGT9Hvzj
SQx7dnJXnLzt5eEq9I63/VxRcKBSiQLFyMCYBxbaf0Ru3X1Z+xLPpJ5wTpkIEUhe
ik75xD92+aDQeKOu5WECAwEAAaNNMEswHQYDVR0OBBYEFGrN5RNdnvrtYiGAqYz/
gnvfYyEAMB8GA1UdIwQYMBaAFGrN5RNdnvrtYiGAqYz/gnvfYyEAMAkGA1UdEwQC
MAAwDQYJKoZIhvcNAQELBQADggEBAEcJuLhZSDYpM+6icKak26A0oYxxLbSX9yJ2
vfnUWcBdV5AC47KwHbkre0VLcB4N0JmXRuxd9Jx/9RZJ5+wOm/vjmpuhqGUKcGEV
nj1bsHqxAZkJ7WI3GD5ebo2iDwkQLGrJYn+EyoI4vKuLNy8G8RO7wO3i58ieRTvm
c7yYb4zmmppPCSLAG4soXGTpWeMYCN3ogQj2r2AWMK8R5P4rNVqpicIIO758GrNX
8RKVP4zMfaBF4hfwehxFJtTd/SoL70UiIYAyktt6U3S7BN+8uImuJYPdjlyc7XwV
0zzlxW+f8BhPEZ8SV9wb6riT0ViU6LV2/qNmxeFJloyiyVFq2Wk=
-----END CERTIFICATE-----
subject=/CN=*.example.com
issuer=/CN=*.example.com
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1444 bytes and written 325 bytes
Verification error: certificate has expired
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 03FC884879FB1BC4E471721134E9FE75E08C0C36047D9A0C4570FE6EABA77F8C
    Session-ID-ctx: 
    Master-Key: 38EE0A6AE709E2DCD11B5C47C19713B78FE3959B42498699D604940A9B62DD64D3C3E03918BF25FD5CECA7403EAE590E
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 10800 (seconds)
    TLS session ticket:
    0000 - a4 da 49 66 62 ff aa e7-be bd 76 58 0e d5 fb 45   ..Ifb.....vX...E
    0010 - d8 44 c8 2e b1 46 e9 22-6e eb e6 e3 0f eb 8f dc   .D...F."n.......
    0020 - 8a 57 16 a0 1b 16 36 33-87 2b a3 38 cc 1b 4e c0   .W....63.+.8..N.
    0030 - f4 3c 9e d7 82 1d 34 ce-b2 bb 18 95 43 33 74 b7   .<....4.....C3t.
    0040 - 24 65 7d 66 94 1e 4f e2-ff 19 e4 71 af bb 51 01   $e}f..O....q..Q.
    0050 - f1 fd 55 26 0d 65 39 aa-ef b2 d4 12 84 29 57 96   ..U&.e9......)W.
    0060 - 01 2b ae 36 c0 82 f6 e3-4e f9 3e 3b 6d 40 8f ae   .+.6....N.>;m@..
    0070 - 9a f0 da 95 c2 61 90 42-38 f6 4f 43 78 a5 f4 a5   .....a.B8.OCx...
    0080 - 16 27 c8 23 81 fe 98 59-52 87 c1 46 71 3a 34 5d   .'.#...YR..Fq:4]
    0090 - 6a 1b eb a8 4d 57 19 ea-0b 47 5e 39 8e 07 23 16   j...MW...G^9..#.
    00a0 - 34 14 f4 0f 0e 4e 13 55-f8 76 10 64 6c 52 e6 c5   4....N.U.v.dlR..
    00b0 - 17 4b 5d 11 89 35 4e ae-97 f1 b7 36 f8 c4 03 56   .K]..5N....6...V

    Start Time: 1552057179
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no

I want to output the results in a file, each host (x) separated by comma, its verification result (which is the text after Verify return code:).

I tried to add the line: | grep "Verify return code:" after the command in the shell script but did not work.

How can I make the shell script print the output as: x,(what comes after "Verify return code:") ?

Example:

example.com,10 (certificate has expired)

1

Using awk:

while read -r x
do
    vreturn=$(echo | openssl s_client -servername "$x" -connect "$x":443 -CApath etc/ssl/certs/ca-certificates.crt 2>/dev/null | awk -F\: '$1 ~ "Verify return code"{print $2}')
    echo "${x},$vreturn"
done <mylist.txt

This will use : as a field separator and set the vreturn variable to the second field of any line containing Verify return code in it's first line.

Also note ; is not required at the end of each line.

I've added the -r option to your read command, mostly out of habit but this will prevent any backslashes that may be in your host names (unlikely) from being interpreted as escape characters.

  • For some reason, it does not loop over all the items in the file. – user9371654 Mar 8 at 15:20
  • I've re-added the echo before the openssl command. Otherwise it appears to wait for keyboard input before moving on – Jesse_b Mar 8 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.