Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can you think of any linux command-line method for saving the certificate presented by a HTTPS server? Something along the lines of having curl/wget/openssl make a SSL connection and save the cert rather than the HTTP response content.

The gui equivalent to what I'm looking for would be to browse to the HTTPS site, double-click on the browser "secure site" icon, and export the cert. Except the goal here is to do it non-interactively.

Thanks, Jim

share|improve this question

Something like:

openssl s_client -servername -connect </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/path/to/certificate.pem

That's what I use with fetchmail to retrieve the certificate of an SSL capable IMAP or POP3 server (except obviously I don't use port 443)

(Note that "redundant" -servername parameter is necessary to make openssl do a request with SNI support.)

share|improve this answer
Very helpful! Thanks! – Jesse Hallett Aug 7 '12 at 21:19


# usage: [port]

echo |\
openssl s_client -connect ${REMHOST}:${REMPORT} 2>&1 |\
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.