Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to download the ssl certificate from, say, using wget or any other commands. Any unix command line? wget or openssl?

share|improve this question

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect HOST:PORTNUMBER | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts

echo -n gives a response to the server, so that the connection is released

sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' removes information about the certificate chain. This is the preferred format to import the certificate into other keystores.

share|improve this answer
appreciate that you not only gave a good answer, but also a precise explanation. – marco.m Jan 24 '14 at 17:13
Does -showcerts show the server/leaf cert too? I thought it only displayed intermediates when that switch was included. – Mike B Apr 30 '14 at 5:56
As the answer said, s_client always shows the server cert (if there is one, i.e. the server responds to hello and doesn't choose an anonymous suite). -showcerts shows all the certs received, server cert first then intermediates and/or root. – dave_thompson_085 May 28 '14 at 8:58
what a great answer. – bitoiu Aug 15 '14 at 15:24
this doesn't work in the presences of a proxy, though. – Frederick Nord Apr 16 '15 at 9:00
up vote 36 down vote accepted

I found the answer. Openssl provides it.

openssl s_client -connect ${REMHOST}:${REMPORT}

share|improve this answer
also openssl x509 -text <<EOF cert-text EOF to see details of the certificate – mpapis Aug 1 '12 at 5:21
sudo rm -f cert.pem && sudo echo -n | openssl s_client -connect localhost:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ./cert.pem courtesy of… – pulkitsinghal Feb 19 '13 at 2:50
this accomplishes the same and skips the sed hack. – phs Dec 10 '13 at 7:13
This just checks one certificate, what if the service is part of a load balanced group of servers, of which each have a different certificate, possibly signed by a different root CA? Or in other words, a mitm attack might let this request go trough to the real site, and then direct other requests to his servers. Are there any ways to check this? And to get a list of all certificates an domain really has? – Jens Timmerman Apr 28 '14 at 10:37
@JensTimmerman "Or in other words, a mitm attack might let this request go trough to the real site, and then direct other requests to his servers." That is not possible unless the man-in-the-middle has a valid certificate for the target server (or the client is silly does not check the server certificate). Evidently, if the server sometimes offers a different certificate you can only hope to probably eventually get them all by repeating connection attempts. – David Tonhofer Aug 4 '15 at 16:08

The GNUTLS client tool, gnutls-cli, can also make this easy:

gnutls-cli --print-cert < /dev/null >

The program is designed to provide an interactive client to the site, so you need to give it empty input to end the interactive session.

share|improve this answer
how would it make gnutls connect through (the system wide configured) https proxy and print the certificate it exchages? – Frederick Nord Oct 26 '15 at 9:55

based on @bignose answer, here is a self-contained version that fits well in e.g. a chef recipe:

sudo apt-get install gnutls-bin 
gnutls-cli --print-cert </dev/null| sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > myserver.crt
sudo cp myserver.crt /usr/local/share/ca-certificates/myserver.crt
sudo update-ca-certificates
share|improve this answer

Alternative syntax using Ex and process substitution:

ex +'/BEGIN CERTIFICATE/,/END CERTIFICATE/p' <(echo | openssl s_client -showcerts -connect -scq > file.crt
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.