Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to download the ssl certificate from, say https://www.google.com, using wget or any other commands. Any unix command line? wget or openssl?

share|improve this question
add comment

3 Answers

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect HOST:PORTNUMBER | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts

echo -n gives a response to the server, so that the connection is released

sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' removes information about the certificate chain. This is the preferred format to import the certificate into other keystores.

share|improve this answer
1  
appreciate that you not only gave a good answer, but also a precise explanation. –  marco.m Jan 24 at 17:13
add comment
up vote 30 down vote accepted

I found the answer. Openssl provides it.

openssl s_client -connect ${REMHOST}:${REMPORT}

share|improve this answer
1  
also openssl x509 -text <<EOF cert-text EOF to see details of the certificate –  mpapis Aug 1 '12 at 5:21
1  
sudo rm -f cert.pem && sudo echo -n | openssl s_client -connect localhost:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ./cert.pem courtesy of serverfault.com/questions/139728/… –  pulkitsinghal Feb 19 '13 at 2:50
    
this accomplishes the same and skips the sed hack. –  phs Dec 10 '13 at 7:13
add comment

The GNUTLS client tool, gnutls-cli, can also make this easy:

gnutls-cli --print-cert www.example.com < /dev/null > www.example.com.certs

The program is designed to provide an interactive client to the site, so you need to give it empty input to end the interactive session.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.