Following the heartbleed vulnerability in openSSL, all the SSH certificate on our servers were re-issued and re-installed.

Since it is likely that we've missed something on a server (for example, restarting Apache), we are checking the servers manually by clicking the key logo in Chrome:

enter image description here

This is slow and error prone. Is there a command line tool that can fetch the certificate ID/Serial number from a server?


I ended up using a variation on MichelZ's answer:

echo "" | openssl s_client -showcerts -status -verify 0 \
        -connect www.mydomain.com:443 2>&1 | \
        egrep "Verify return|subject=/serial"
  • echo is necessary for openssl to exit (it waits for input otherwise).
  • -verify 0 verifies the certificate.
  • 2>&1 redirects standard error to standard output
  • egrep shows only the validation status and the serial number.
  • 1
    don't forget to use -servername for SNI (server name indication) when you have multiple vhosts. – minusf Mar 6 '19 at 14:16

You can use OpenSSL to retrieve the certificate:

openssl s_client -showcerts -connect some_server:server_port
  • Great, thanks. I've adapted your answer to my needs and it works perfectly. Thanks! – Adam Matan Apr 17 '14 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.