Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a server that needs to work with SSL. We're having some problems with the SSL certificates. Does anybody know a good certificate analyzer that can tell me what is wrong?

It is an internal server, so I can't use an online test site.

share|improve this question

5 Answers 5

up vote 1 down vote accepted

We recently got some certificates from GeoTrust and used their checker here to make sure everything was working - unsure if it will work with certificates from other authorities.

share|improve this answer
    
The server can't go beyond the firewall... so an online tool is out of the question. –  Kees C. Bakker Apr 4 '11 at 9:12
1  
Ah... it's a Java tool :-) handy –  Kees C. Bakker Apr 4 '11 at 9:14

Openssl commands will help you to find out details of SSL certs. Check this link.

http://techtrunch.com/commands/checking-ssl-certs-validity-details

share|improve this answer

You may use openssl to check a host's ssl certificate (+chain) and tell you what it thinks is wrong with it:

openssl s_client -connect <host>:<port> < /dev/null
share|improve this answer

There are some free online test tools out there.

E.g. http://www.ssltest.net/

share|improve this answer
    
The server can't go beyond the firewall... so an online tool is out of the question. –  Kees C. Bakker Apr 4 '11 at 9:12

Describe the problems with SSL? There's lots of stuff that can go wrong, from CRL locations being inaccessible (for Internet-blocked servers) to, well, just about anything.

Simplest in-box mechanism is typically to open the certificate in the certificates MMC.

  • Every certificate you need to use needs an associated private key. There's text at the bottom of the General properties page that indicates whether you do or not.

  • For servers, the certificate needs an intended purpose that includes Server Authentication.

If that looks OK, proceed to CERTUTIL -verify certfile.cer (potentially throw in -urlfetch as well).

But again: describe the problems, cos that'll point to possible solutions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.