![如何通过 openssl 二进制文件下载域名的所有已公布的 SSL 证书?](https://linux22.com/image/1566592/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%20openssl%20%E4%BA%8C%E8%BF%9B%E5%88%B6%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E5%9F%9F%E5%90%8D%E7%9A%84%E6%89%80%E6%9C%89%E5%B7%B2%E5%85%AC%E5%B8%83%E7%9A%84%20SSL%20%E8%AF%81%E4%B9%A6%EF%BC%9F.png)
问题
假设我想下载特定网站的每个 SSL 证书,以便以后能够进行证书固定。
如何使用 openssl 查询 Web 服务器,以下载所有可用的证书而不需要知道它们的任何属性?
示例
域名 api.cyberghostvpn.com 具有以下签名的证书:
- ECDSA+SHA256
- RSA+SHA256
- RSA+SHA1
要下载这些内容,您可以使用以下命令:
回声 | \
openssl s_client -connect api.cyberghostvpn.com:443 2>/dev/null -sigalgs 'ECDSA+SHA256' 2>/dev/null | \ openssl x509 -outform DER > api_ECDSA+SHA256.crt
回声 | \ echo | \
openssl s_client -connect api.cyberghostvpn.com:443 2>/dev/null -sigalgs 'RSA+SHA256' 2>/dev/null | \ openssl x509 -outform DER > api_RSA+SHA256.crt
回声 | \
openssl s_client -connect api.cyberghostvpn.com:443 2>/dev/null -sigalgs 'RSA+SHA1' 2>/dev/null | \ openssl x509 -输出 DER > api_RSA+SHA1.crt
回复
@Seth:
您无需成为域名所有者即可对网站的公共 SSL 证书感兴趣。
就我而言,我对这些证书感兴趣,因为我现在在编写的自定义 TrustManager (Java) 中使用它们的指纹,以确保获得正确的证书。我在自定义 okHTTP 客户端中使用它,这样我就可以直接连接到 api 服务器(知道 IP),而无需进行 DNS 查找(在某些国家/地区可能会被阻止...)。Cloudflare 不允许在其 Web 界面下载这些证书。
@Alex:
第一条评论
- 这些命令实际上是逐个执行的(超级用户删除了我的行...抱歉) - 您的回答:
您的命令仅打印出此有效 SSL 连接的证书链。
该链从根权限开始,以服务器证书结束。
服务器上安装了多个 SSL 证书以提高客户端兼容性(因此较新的客户端可以建立更安全的连接)。我上面指定的每个命令都会根据我使用“-sigalgs”允许的密码套件 + 哈希算法下载不同的服务器证书。
第二条评论
你不相信我?看看输出!
- 序列号:
- 96:4f:da:8c:12:ff:3f:c0:9b:65:71:33:31:f6:fc:7e
- 1f:78:84:e8:e5:e8:72:7b:43:36:12:7f:15:32:14:46
- 是:b3:dc:01:de:39:74:99:7b:99:a1:db:97:d4:34:46
- 签名算法:
- sha256WithRSAEncryption
- sha1WithRSAEncryption
- ecdsa-带-SHA256
- 主题备用名称
- DNS:ssl366066.cloudflaressl.com
- DNS:*.cyberghostvpn.com
- DNS:cyberghostvpn.com
第一个证书:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
96:4f:da:8c:12:ff:3f:c0:9b:65:71:33:31:f6:fc:7e
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA 2
Validity
Not Before: Mar 3 00:00:00 2018 GMT
Not After : Sep 9 23:59:59 2018 GMT
Subject: OU=Domain Control Validated, OU=PositiveSSL Multi-Domain, CN=ssl366066.cloudflaressl.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:cd:47:a0:24:81:11:b2:8a:6d:e5:91:02:f0:0e:
d6:46:92:5f:28:4b:0c:9e:66:f8:e9:1d:d4:1f:4f:
64:70:4a:5d:e9:a2:a6:cc:71:dc:76:15:f3:8a:6c:
59:e1:9c:5c:38:46:de:53:9b:c3:2d:87:c0:49:1b:
a2:68:1a:fb:ba:f7:5b:ec:b4:f9:92:85:1e:72:12:
78:94:47:ac:b9:3d:a3:cf:03:ed:18:e0:d0:8e:1f:
6b:59:49:f4:76:57:19:18:74:38:e1:77:45:74:7f:
ce:c4:59:77:4a:25:7b:88:58:9d:9f:ac:8c:4a:b6:
8c:cc:46:9b:9e:33:6d:52:26:6a:e3:b3:5d:6d:4a:
0a:e9:a0:4f:a8:3b:c4:cd:5f:1c:f9:50:7a:0d:da:
f1:ca:61:50:c2:56:52:ba:33:80:05:24:9a:58:49:
ff:90:36:de:06:24:32:29:47:2b:7d:ec:a5:ab:f7:
a6:fd:cf:04:46:02:b4:6b:d2:39:ee:f1:66:d5:e2:
23:1b:46:b8:d0:6d:e4:d1:1f:5d:26:e4:5e:44:6b:
b2:7b:bc:81:17:56:51:92:ec:61:95:bf:9a:56:8f:
5d:3d:66:e5:74:1a:a5:42:a6:ca:6d:4f:49:44:19:
5f:b8:e5:64:8a:24:31:80:32:bf:c7:7e:09:0a:7e:
19:ed
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:D4:B0:F4:FD:4F:9C:42:A4:6C:DC:3D:2E:EE:5B:41:18:C9:AD:03:F6
X509v3 Subject Key Identifier:
5C:DD:94:66:77:CE:58:18:D8:64:2B:82:2E:3F:7F:F2:95:03:6B:84
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.2.7
CPS: https://secure.comodo.com/CPS
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl
Authority Information Access:
CA Issuers - URI:http://crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt
OCSP - URI:http://ocsp.comodoca4.com
X509v3 Subject Alternative Name:
DNS:ssl366066.cloudflaressl.com, DNS:*.cyberghostvpn.com, DNS:cyberghostvpn.com
Signature Algorithm: sha256WithRSAEncryption
3f:a2:7c:83:b5:e4:22:33:a1:c0:07:a3:7e:d0:8b:06:2f:d3:
6e:d6:c2:2f:a5:66:49:0c:bb:39:dc:1c:be:0e:a3:ba:44:e9:
3d:99:34:e7:3b:9d:4f:60:35:d1:52:fc:63:7d:a8:08:9e:52:
24:36:8e:d0:89:4d:44:4e:d4:7c:9d:fd:87:dd:b6:7c:51:26:
90:25:89:eb:88:0a:d5:37:18:bb:14:8b:d5:f6:2a:f0:f3:fc:
31:04:db:d9:90:00:cc:e4:92:f6:cb:6c:fd:2e:af:ce:a0:fe:
c6:54:58:fd:fc:43:bb:48:be:03:15:c0:95:54:1f:4f:8e:34:
c1:b1:06:46:1d:69:3e:ca:8c:8b:91:07:4d:64:d2:46:48:9d:
2e:9e:3f:da:f5:73:7b:2c:07:f3:89:89:e0:93:78:9f:b4:be:
3d:d6:b7:3a:ba:20:a7:1f:3b:f0:8e:5b:d1:ea:07:8b:9c:a6:
3d:16:56:a2:2e:c9:f7:81:9c:af:c5:65:00:0a:eb:49:c9:23:
a0:70:8d:3d:4a:50:73:64:d8:49:f0:5f:b2:c9:bc:99:78:6f:
53:73:83:74:ac:00:c4:3e:cf:d6:5a:2d:57:5e:3d:60:b3:02:
bd:3d:66:89:c7:9c:e4:3e:89:5d:7c:14:a3:f5:3c:42:fd:a4:
0a:06:9b:fe
第二证书
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
1f:78:84:e8:e5:e8:72:7b:43:36:12:7f:15:32:14:46
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Domain Validation Legacy Server CA 2
Validity
Not Before: Mar 2 00:00:00 2018 GMT
Not After : Sep 8 23:59:59 2018 GMT
Subject: OU=Domain Control Validated, OU=Legacy Multi-Domain SSL, CN=ssl366065.cloudflaressl.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:cb:9c:14:cd:c9:78:7e:0d:9a:1b:af:98:bd:6d:
21:c7:12:04:d4:97:fd:de:bc:ea:a9:fd:d4:2b:e7:
d0:98:b5:54:f2:2b:aa:6c:fb:60:86:9c:cf:ae:d4:
e3:fe:ad:b9:95:f0:ae:c5:9b:9f:f3:3a:51:93:55:
7a:e6:62:4e:47:5c:15:b8:f0:64:a3:07:6a:f1:32:
8b:7f:f8:d6:2b:ed:34:67:25:95:b0:f2:e8:ac:aa:
cf:e2:7c:a8:39:10:c5:c5:78:e8:69:f4:44:67:94:
7f:88:36:2d:0f:a5:c9:a1:4f:eb:04:7f:06:c3:c7:
c3:5a:8b:ea:65:e4:78:98:57:67:4e:98:7d:63:e1:
7f:4d:90:93:35:ac:57:a2:7a:82:36:c4:73:5c:c2:
a2:26:87:c6:2d:db:ec:9f:d8:89:84:a8:b9:c0:fe:
7b:e9:c7:11:61:f7:8c:48:2c:86:65:0a:08:8f:1f:
10:e0:3a:f4:2e:1d:f3:92:5e:4b:46:97:37:d9:6b:
dd:ca:ed:a4:7f:b5:8e:85:66:a0:b7:a7:e8:89:46:
cf:fd:78:f7:bc:dd:fc:29:d1:5f:1e:89:ba:2e:44:
f6:ba:36:32:4e:99:d7:53:13:a6:76:9a:4f:a0:15:
91:bd:83:08:20:7c:cc:be:9e:c9:ae:8d:c8:ad:ab:
cd:1d
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:99:8E:02:95:C5:1E:55:22:7B:87:70:8B:5E:1C:01:C2:76:C4:AE:E8
X509v3 Subject Key Identifier:
58:D9:A7:F4:57:FE:6E:E2:E9:D0:F0:80:E3:25:07:6B:B3:20:17:AC
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.2.7
CPS: https://secure.comodo.com/CPS
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.comodoca4.com/COMODODomainValidationLegacyServerCA2.crl
Authority Information Access:
CA Issuers - URI:http://crt.comodoca4.com/COMODODomainValidationLegacyServerCA2.crt
OCSP - URI:http://ocsp.comodoca4.com
X509v3 Subject Alternative Name:
DNS:ssl366065.cloudflaressl.com, DNS:*.cyberghostvpn.com, DNS:cyberghostvpn.com
Signature Algorithm: sha1WithRSAEncryption
07:1b:13:eb:96:01:9f:da:7d:80:5f:72:92:c0:bd:6b:86:ea:
b5:5b:e6:35:6b:c7:dc:a1:1b:65:62:69:3f:bd:45:af:8e:ca:
95:76:c9:69:97:8d:2f:b2:36:96:e9:41:ab:fe:7a:36:fb:ce:
e9:f5:5d:fb:01:40:7e:6f:d9:e7:24:ac:a2:99:b3:2c:3b:dc:
4c:cc:69:90:ed:6e:da:0c:a0:86:95:dd:69:65:a4:de:41:51:
85:2e:1c:3c:56:00:ae:d6:4d:bb:e7:e8:8c:94:f9:fe:cc:0c:
c2:41:62:5d:64:b4:0e:53:67:56:c1:db:87:75:5a:e9:6c:01:
be:45:aa:92:fa:e8:4f:7a:a1:44:f9:00:48:a7:55:ee:d6:9b:
1f:9e:70:e0:fa:c5:7e:cd:9b:d8:c8:a1:e8:bb:4d:7f:31:ef:
9a:cf:27:ff:39:f7:ce:80:9d:11:cc:d1:29:69:de:ad:04:51:
cd:b1:8e:af:63:00:d4:08:e7:90:5c:f1:82:8e:8f:0d:0d:8c:
42:1e:17:ce:6a:20:00:77:04:cc:c2:e3:11:af:78:3b:3c:0b:
d2:4e:1d:5a:ec:58:77:09:15:bc:f0:0e:cf:fa:ea:51:1c:19:
a3:5f:69:cb:f4:8a:83:f7:2c:de:a1:5f:2e:fe:47:06:e0:87:
8e:3b:12:52
第三個證書:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
be:b3:dc:01:de:39:74:99:7b:99:a1:db:97:d4:34:46
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Domain Validation Secure Server CA 2
Validity
Not Before: Mar 2 00:00:00 2018 GMT
Not After : Sep 8 23:59:59 2018 GMT
Subject: OU=Domain Control Validated, OU=PositiveSSL Multi-Domain, CN=ssl366067.cloudflaressl.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:92:0b:93:8a:65:ce:02:eb:f9:81:be:cf:54:19:
eb:5b:b4:ce:61:1b:32:25:b0:ca:da:e1:1a:b9:59:
98:cd:d0:0a:81:0d:4a:99:1b:e8:f5:fd:e1:1f:7b:
07:36:a9:85:4f:17:54:f3:71:1a:ee:1b:ad:af:98:
7c:55:97:7a:7b
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:40:09:61:67:F0:BC:83:71:4F:DE:12:08:2C:6F:D4:D4:2B:76:3D:96
X509v3 Subject Key Identifier:
C6:2E:B1:E7:71:C3:3E:B8:B6:B5:2F:34:8A:5A:06:ED:EB:15:A1:60
X509v3 Key Usage: critical
Digital Signature
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.2.7
CPS: https://secure.comodo.com/CPS
Policy: 2.23.140.1.2.1
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crl
Authority Information Access:
CA Issuers - URI:http://crt.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crt
OCSP - URI:http://ocsp.comodoca4.com
X509v3 Subject Alternative Name:
DNS:ssl366067.cloudflaressl.com, DNS:*.cyberghostvpn.com, DNS:cyberghostvpn.com
Signature Algorithm: ecdsa-with-SHA256
30:46:02:21:00:bf:a3:b1:95:e2:2f:42:5f:8c:e3:f5:24:5f:
7b:cb:6b:22:bc:98:47:3e:31:6c:25:9d:fc:15:36:9a:26:45:
b9:02:21:00:82:32:aa:6e:e3:6f:5f:41:b9:91:e1:bd:0e:39:
e4:2c:35:60:ce:8a:72:db:6e:48:63:e7:6b:44:5a:f3:4c:5e
答案1
如果您无法访问服务器,那么找出服务器将支持哪些签名算法的唯一方法是依次尝试每个算法,这与您所做的类似,但涵盖了所有可能性。一个简单的脚本就可以为您做到这一点。假设您可以访问类似 Unix 的 shell:
for sign in RSA DSA ECDSA; do
for digest in MD5 SHA1 SHA224 SHA256 SHA384 SHA512; do
sigalgs="${sign}+${digest}"
echo "Trying $sigalgs"
echo | openssl s_client -connect api.cyberghostvpn.com:443 -sigalgs "$sigalgs" 2> /dev/null > "${sigalgs}.cer"
if [ $? != 0 ]; then rm "${sigalgs}.cer"; fi
done
done
奇怪的是,并非所有服务器都遵守 ClientHello 消息中的 SignatureAlgorithm 扩展。 所有 RSA 请求www.google.com
都会返回,但 DSA 和 ECDSA 则会失败。sha256withRSAEncryption