Showcert
showcert is openssl for humans. (showcert has only 1% of openssl features, but covers 99% of typical needs and much easier to use)
OpenSSL hates you
# two redirections, pipe, two invokation of same binary, extra 5 options (s_client, -connect, x509, -inform, -text)
# And you probably want to add one more pipe and grep to extract what you need (expiration date) from two screens of output
# I forgot exact command to hack Pentagon, but it was little bit shorter
openssl s_client -connect github.com:443 </dev/null 2>/dev/null | openssl x509 -inform pem -text
Install
pip3 install showcert
Usage
View remote HTTPS server cert (you will never forget syntax):
$ showcert github.com
IP: 140.82.121.3
Names: github.com www.github.com
notBefore: 2022-03-15 00:00:00 (337 days old)
notAfter: 2023-03-15 23:59:59 (28 days left)
Issuer: C=US O=DigiCert Inc CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1
View remote certificate for other ports/protocols, (with auto STARTTLS support for SMTP/IMAP/POP3):
$ showcert smtp.google.com:25
IP: 66.102.1.26
Names: mx.google.com smtp.google.com aspmx.l.google.com alt1.aspmx.l.google.com alt2.aspmx.l.google.com alt3.aspmx.l.google.com alt4.aspmx.l.google.com gmail-smtp-in.l.google.com alt1.gmail-smtp-in.l.google.com alt2.gmail-smtp-in.l.google.com alt3.gmail-smtp-in.l.google.com alt4.gmail-smtp-in.l.google.com gmr-smtp-in.l.google.com alt1.gmr-smtp-in.l.google.com alt2.gmr-smtp-in.l.google.com alt3.gmr-smtp-in.l.google.com alt4.gmr-smtp-in.l.google.com mx1.smtp.goog mx2.smtp.goog mx3.smtp.goog mx4.smtp.goog aspmx2.googlemail.com aspmx3.googlemail.com aspmx4.googlemail.com aspmx5.googlemail.com gmr-mx.google.com
notBefore: 2023-01-31 10:21:33 (15 days old)
notAfter: 2023-04-25 10:21:32 (68 days left)
Issuer: C=US O=Google Trust Services LLC CN=GTS CA 1C3
Save gmail SMTP certificate (whole chain) in PEM format:
$ showcert --chain -o pem smtp.google.com:25 > gmail-fullchain.pem
$ file gmail-fullchain.pem
/tmp/gmail.pem: PEM certificate
Or you may use -o full
to get openssl-style full dump (but I never really needed it).
It has other features (For example, it can warn you if any of installed LetsEncrypt certificates failed to renew and expires in N days), but main design principle: Simple things must be simple, more complex things may require additional CLI options.
Disclaimer: showcert is my hobby project, so I can be biased.
curl
with flag--verbose
shows the full server certificate content.