Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed.
Since it is likely that we've missed something on a server (for example, restarting Apache), we are checking the servers manually by clicking the key logo in Chrome:
This is slow and error prone. Is there a command line tool that can fetch the certificate ID/Serial number from a server?
I ended up using a variation on MichelZ's answer:
echo "" | openssl s_client -showcerts -status -verify 0 \ -connect www.mydomain.com:443 2>&1 | \ egrep "Verify return|subject=/serial"
echois necessary for
opensslto exit (it waits for input otherwise).
-verify 0verifies the certificate.
2>&1redirects standard error to standard output
egrepshows only the validation status and the serial number.