0

Is it possible to check the issued and expiry dates for the certificates involved in a certificate chain by just passing a domain?

I tired various openssl s_client attributes, but I am not able to get the required information.

Requirement:

Pass a domain (along with port 443), and using a script or a command in linux output the issued and expiry dates involved in the certificate chain for the domain(web server).

3

The answer is yes, you can do it with openssl, you can easily wrap this up as a "check" script, but I'm not aware of a plugin that already does this.

First, cache the server certificate and entire chain:

echo Q | openssl s_client -connect www.google.com:443 -showcerts > chain.pem

(this chain file contains the site certificate, the intermediate chain, along with other junk -- this does not present a problem for openssl though)

If you only wish to output the details of each certificate in the chain file:

gawk 'BEGIN { pipe="openssl x509 -noout -subject -dates -serial "} \
  /^-+BEGIN CERT/,/^-+END CERT/ { print | pipe }
  /^-+END CERT/                 { close(pipe); printf("\n")}  ' chain.pem

Add/omit -serial, -issuer, -fingerprint, -purpose as preferred. You can even glue those together as one line with (taking care to omit the redirection and chain.pem occurrences):

echo Q | openssl ... | gawk ...

If you wish to properly validate the chain, including date ranges, then read on.

Next, pull out just the site (first) certificate, I'll use sed here because I'm lazy ;-)

sed -n '/-BEGIN/,/-END/p;/-END/q' chain.pem > site.pem

Then verify:

openssl verify -verbose -CAfile chain.pem site.pem

This is where the wheels come off: Google (correctly) doesn't provide the (self-signed) root CA in the chain:

site.pem: /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
error 2 at 2 depth lookup:unable to get issuer certificate

So, pull the root certificate from Geotrust, save it and and set it up a suitable CA directory:

cd /usr/local/nagios/var/CA  # example!
wget http://www.geotrust.com/resources/root_certificates/certificates/Equifax_Secure_Certificate_Authority.pem
c_rehash .

And try again:

openssl verify -verbose -CAfile chain.pem -CApath /usr/local/nagios/var/CA site.pem  

(note the extra -CApath parameter) and you get:

site.pem: OK  

Now the bad news, openssl doesn't set the return code to indicate success, failure or anything useful. You will need to process the output to make sure that everything is ok, basically anything other than a single line with "OK" indicates a problem. The expired certs you are looking for will show as:

error 10 at 2 depth lookup:certificate has expired

(where the depth may vary).

Notes and caveats:

  • the server-provided chain might not contain the root (it need not, and if it does, the client ought ignore it), work around this by adding -CApath /some/path to point to a directory of pre-hashed trusted roots as shown
  • this does not catch mis-ordering of the chain file, nor superfluous certs in the chain file (neither are usually a problem for browsers, but a site validator will usually flag them)
  • the chain.pem created here has extra junk in it, this doesn't present a problem for openssl
1

I'm not aware of a plugin to check issue dates, but checking the expiration date of certificates is a standard feature of the check_http plugin.

Specifically, see the -C option. As in:

./check_http -H www.google.com -C 14
OK - Certificate 'www.google.com' will expire on 09/11/2014 11:04.

Note that this will work on anything that uses SSL (LDAPS, IMAPS, etc.), not just HTTPS.

If you want to check certificates in the chain, you might want to try something like check_ssl_cert. (I have never used it, but the usage info looks like it does what you want.)

  • Thanks, Keith. But as per my requirement I will need to get the expiry dates(at-least) of the certificates involved in a certificate chain and not just the server certificate as you have mentioned above. A Certificate chain will involve the Root, CA, Intermediate CA certificates...etc. – Ajov Crowe Sep 25 '13 at 7:46
  • Ah, missed that. Updated answer with another suggesting. – Keith Sep 26 '13 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.