例如,我想了解 crypto.google.com 的证书何时到期(即Not After
日期),以及哪些其他域可以使用它进行身份验证(主题备用名称)。
答案1
你可以简单地写它:
openssl s_client -showcerts -connect encrypted.google.com:443 < /dev/null \
2> /dev/null | openssl x509 -noout -enddate
其他选项-enddate
可用于检索其他字段。-text
输出大部分信息。
另请参阅keytool
java:
keytool -printcert -sslserver encrypted.google.com:443
如果可能的话,它将打印整个证书链(可能从 Java 证书存储中检索到一些证书)。
答案2
要使用 openssl 将服务器的证书打印为文本:
#!/bin/bash
#
# Show server's certificate in a human-readable form.
#
# Usage: $ show-cert HOST [PORT]
#
exec <&- # close stdin to suppress `read:errno=0` from openssl
exec openssl x509 -noout -text \
-in <(openssl s_client -connect "$1":"${2:-443}" -showcerts)
或者使用Python获取json格式的输出:
#!/usr/bin/env python3
"""Show server's certificate as json.
Usage:
$ %(prog)s HOST [PORT]
"""
import json
import socket
import ssl
import sys
def getcert(addr, timeout=None):
"""Retrieve server's certificate at the specified address (host, port)."""
# it is similar to ssl.get_server_certificate() but it returns a dict
# and it verifies ssl unconditionally, assuming create_default_context does
with socket.create_connection(addr, timeout=timeout) as sock:
context = ssl.create_default_context()
with context.wrap_socket(sock, server_hostname=addr[0]) as sslsock:
return sslsock.getpeercert()
def main(argv):
host = argv[1]
port = int(argv[2]) if len(argv) > 2 else 443
print(json.dumps(getcert((host, port)), indent=2, sort_keys=True))
if __name__ == "__main__":
main(sys.argv)
例子:
$ getcert encrypted.google.com | jq -r '.notAfter, .subjectAltName[][1]'
Mar 20 00:00:00 2014 GMT
*.google.com
*.android.com
*.appengine.google.com
*.cloud.google.com
...
最新版本:getcert.py