You should be able to use OpenSSL for your purpose:
echo | openssl s_client -showcerts -servername gnupg.org -connect gnupg.org:443 2>/dev/null | openssl x509 -inform pem -noout -text
That command connects to the desired website and pipes the certificate in PEM format on to another openssl command that reads and parses the details.
(Note that "...
Think I found a solution going through the cURL manual:
curl https://DOMAIN.EXAMPLE --resolve 'DOMAIN.EXAMPLE:443:192.0.2.17'
Added in [curl] 7.21.3. Removal support added in 7.42.0.
from CURLOPT_RESOLVE explained
Yeah, you can do that, as curl --help or man curl would have told you:
(SSL) This option explicitly allows curl to perform "insecure" SSL
connections and transfers. All SSL connections are attempted to be
made secure by using the CA certificate bundle installed by default.
This makes all connections considered "insecure" fail ...
For RHEL 6 or later, you should be using update-ca-trust, as lzap describes in his answer below.
--- For older versions of Fedora, CentOS, Redhat:
Curl is using the system-default CA bundle is stored in /etc/pki/tls/certs/ca-bundle.crt . Before you change it, make a copy of that file so that you can restore the system default if you need to. You can ...
You are correct -- lighttpd doesn't support POST requests with an empty message body without a 'Content-Length' header set to zero, and CURL sends such a request. There's argument back and forth about who's right, but in my opinion, lighttpd is broken. A POST with no Content-Length and no Transfer-Encoding is perfectly legal and has no message body.
The recommended way of doing that on RHEL 6+ systems is to use update-ca-trust tool, which is now installed by default.
# cat /etc/pki/ca-trust/source/README
This directory /etc/pki/ca-trust/source/ contains CA certificates and
trust settings in the PEM file format. The trust settings found here will be
interpreted with a high priority - higher than the ...
Use '&' after a command to background a process, and 'wait' to wait for them to finish. Use '()' around the commands if you need to create a sub-shell.
curl -s -o foo http://example.com/file1 && echo "done1" &
curl -s -o bar http://example.com/file2 && echo "done2" &
curl -s -o baz http://example.com/file3 &&...
You can use the -d option in curl with a @- argument to accept input from a pipe. You will need to construct the key-value pairs yourself. Try this:
echo "time=`uptime`" | curl -d @- http://URL
The backticks (`) denote that the enclosed command (in this case uptime) should be executed, and the backtick-quoted text replaced with the output of the executed ...
nmap -p 443 --script ssl-cert gnupg.org
The -p 443 specifies to scan port 443 only. All ports will be scanned if it is omitted, and the certificate details for any SSL service that is found will be displayed. The --script ssl-cert tells the Nmap scripting engine to run only the ssl-cert script. From the doc, this script "(r)etrieves a server's SSL ...
I saw a similar kind of problem, yet not accessing twitter.
Problem I saw was on RHEL 6.1 -> RHEL 6.4, using curl to access a REST API.
curl showed error:
curl: (35) SSL connect error
Issue ended up being that our server running the REST API was RHEL 6.6, using a newer version of NSS. Once we upgraded the client NSS version curl was successful.
instead of using wget, curl works like this:
curl --silent http://domain.com/cron.php
which will work in the same way as wget. if its a php file you are launching, is there any reason you cant run it via the command line php interpreter like so:
php -q /path/to/cron.php
same on a webserver request and often will work much faster and without certain ...
wget(1) works sequentally by default, and has this option built in:
Read URLs from a local or external file. If - is specified as file, URLs are read from the standard input. (Use ./- to read from a file literally named -.)
If this function is used, no URLs need be present on the command line. If there are ...
I've been having the same trouble and after poking around a bit found that you can download a package of CA-certs ready for curl on ubuntu directly from the curl dev site.
sudo wget http://curl.haxx.se/ca/cacert.pem
Now curl uses the most up-to-date bundle and you're good to go.
Running curl with strace might give you a clue.
strace curl https://www.google.com |& grep open
Lots of output, but right near the end I see:
open("/etc/ssl/certs/578d5c04.0", O_RDONLY) = 4
which is where my certificates are stored.
There should be a program 'curl-config' in curl's 'bin/', i.e. where the 'curl' binary resides.
gives the ca bundle install path.
I just did a whatis curl-config: "Get information about a libcurl installation" so I guess it will only be available if libcurl was installed, which I presume is standard though.
You likely will need to troubleshoot this from the server side, not the client side. I believe you are confusing an 'empty response' with 'no response'. They do not mean the same thing. Likely you are getting a reply that does not contain any data.
You can test this by simply using telnet instead of going through curl:
telnet 220.127.116.11 80
If the server sends you a TLS alert unknown ca like in this case then the server does not accept the client certificate you have send (-E my.pem). One reason for this might be that you have used the wrong certificate. Another reason might be that you've used the correct certificate but failed to add the necessary chain certificates.
curl -I will generate a HEAD request.
Adding the -L option will make it follow redirects.
Timeouts can be controlled with several options depending on which bit of the request you want to time out.
From the man page:
Maximum time in seconds that you allow the connection to the server to take. This only limits ...
What you would need to do is:
If you still get an SSL warning try:
wget --no-check-certificate https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
Then you can
rpm -Uvh webtatic-release.rpm
Which should show up here:
Your curl command is running as root (via sudo) but your php command is not. Try moving your sudo between the pipe ("|") and 'php' (assuming you want your installer to run as root in the first place...).
You can change in /etc/hosts to make the server think that the domain is located at a certain IP.
This is the syntax:
This will make cURL use the IP-address you want without the SSL-certificate to break.
There is no wget like built-in command in Windows. You can use the .net Framework via Windows PowerShell like in this example:
or like i do and use wget for Windows:
I would expect curl to us the resolver library which will use the name service providers listed in the /etc/nsswitch.conf hosts specification in order. If this does not include DNS, DNS resolution will not occur. nslookup is not documented to use this file, but from your experience it appears it may. Often this data is cached by a name service caching ...