how to download ssl certificate from a website?

Question

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?

Answer 1

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect HOST:PORTNUMBER | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts

echo -n gives a response to the server, so that the connection is released

sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' removes information about the certificate chain. This is the preferred format to import the certificate into other keystores.

Answer 2

I found the answer. Openssl provides it.

openssl s_client -connect ${REMHOST}:${REMPORT}

Answer 3

The GNUTLS client tool, gnutls-cli, can also make this easy:

gnutls-cli --print-cert www.example.com < /dev/null > www.example.com.certs

The program is designed to provide an interactive client to the site, so you need to give it empty input to end the interactive session.