31

With a slightly older version of curl, I had a handy batch file:

curl --verbose -k https://%1 2>&1 |grep -E "Connected to|subject|expire"

This would show me the IP connected to, with the subject and expiration date of the actual certificate negotiated, even if that was not the correct certificate for that domain name -- which is sometimes a problem for our hosting (we host literally thousands of domains on our multitenant application, about half with their own certs).

In specific, I would see something like this in the stderr output before grep filtered it:

* Server certificate:
*  subject: CN=academy-fran.chi.v6.pressero.com
*  start date: Feb 22 04:55:00 2017 GMT
*  expire date: May 23 04:55:00 2017 GMT
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.

Today I had to reinstall the OS on my machine, and reinstalled curl. Now at version 7.52.1 (x86_64-w64-mingw32); previous one seems to have been 7.49.1 (i686-pc-cygwin). Curl no longer displays ANY certificate information, regardless of whether -k is used or not, if the TLS connection succeeds or not.

Is there an option that will give it back to me?

3 Answers 3

47

For anyone else on OSX or Linux, you can add this to your ~/.zshrc file:

function seecert () {
  nslookup $1
  (openssl s_client -showcerts -servername $1 -connect $1:443 <<< "Q" | openssl x509 -text | grep -iA2 "Validity")
}

Example usage, after you have run a source ~/.zshrc after the above additions:

% seecert www.google.com
Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
Name:   www.google.com
Address: 172.217.10.100

depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com
verify return:1
DONE
        Validity
            Not Before: Nov  3 07:39:18 2020 GMT
            Not After : Jan 26 07:39:18 2021 GMT

Thanks go to @ross-presser and his answer for the inspiration for this function.

6
  • I'm a little confused -- similar to my answer, you ended with grep "DNS After", but there's no DNS AFTER in your example usage output? Commented Dec 19, 2019 at 18:38
  • you are right. grep "DNS After" fails and therefore does not print stdout. you can achieve the same with > /dev/null or simply by | false
    – Lajos
    Commented Dec 3, 2020 at 14:50
  • 1
    I have updated the answer above based on both of your comments, it should function correctly now. My initial answer also did miss the cert validity which was part of the original question, and my mistake. It is corrected now Commented Dec 5, 2020 at 15:02
  • To clarify -- findstr /I "DNS After" from my answer will match either string in the output. Unlike grep which does a regex search. That's what must have tripped up @MylesSteinhauser when first adapting my answer. Commented Mar 12, 2021 at 16:11
  • 1
    @GertvandenBerg Yes, based on a recent manual page entry: openssl.org/docs/man1.1.0/man1/openssl-s_client.html#OPTIONS -proxy host:port could be included in the function above. You could reference the canonical HTTP_PROXY environment variable in your function,too. Commented Aug 20, 2021 at 13:42
9

If you do not wish to use ssl_client, on newer versions of Windows (both server and client versions) where curl.exe is installed by default but no openssl is available, curl.exe is able to help by using the

-w, --write-out <format>

option like this

-w '\n%{certs}\n'

In the result you'll find lines like

Subject:CN=<a host name>
Issuer:<an issuer string>
Version:2
Serial Number:<some two digit hex chars>
Signature Algorithm:sha256WithRSAEncryption
Start Date:2023-03-14 00:00:00 GMT
Expire Date:2024-04-13 23:59:59 GMT
Public Key Algorithm:rsaEncryption
RSA Public Key:2048
rsa(n):<lots of two digit hex chars>
rsa(e):0x10001
Signature:<lots of two digit hex chars>

Source for this answer was found by carefully reading the curl online manual page. Checked version:

curl.exe --version
curl 8.0.1 (Windows) libcurl/8.0.1 Schannel WinIDN
Release-Date: 2023-03-20

I need this information to check if our company proxy opens the SSL/TLS encryption, checks it for malicious code, and reencrypts it before sending it to the client and use it in a way like this:

curl.exe --ssl-no-revoke -w '\n%{certs}\n' --proxy http://proxy-server:port/ https://target-server:port/path/of/the/resource.ending

edit: typo fixed

2
  • The only trick with this pony is that you need to be running curl 7.88. If you get an "unknown variable" error, you likely have an older version. To check your version: curl -V
    – John T.
    Commented Jan 25 at 22:05
  • Ssl_client answers aren't "invalid" -- sslclient still works, u just have to go out and get it, which isn't hard. Commented Jan 28 at 14:43
5

Here is my replacement batch file, using openssl instead of curl:

@echo off
nslookup %1
(openssl s_client -showcerts -servername %1 -connect %1:443 <nul |openssl x509 -text |findstr /I "DNS After") 2>nul

This gives me this output:

C:\>seecert www.google.com
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   www.google.com
Address: 172.217.10.228
Name:   www.google.com
Address: 2607:f8b0:4006:813::2004

            Not After : Aug 16 09:49:00 2018 GMT
                DNS:www.google.com
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.