The following command will extract the server certificate
echo -n | openssl s_client -connect google.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
(In OpenSSL 1.1.0(f) you can also use the option -proxy host:port)
Result of the above input:
-----BEGIN CERTIFICATE-----
MIIH0DCCBrigAwIBAgIIGl5CY3EClwgwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE
BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
cm5ldCBBdXRob3JpdHkgRzIwHhcNMTYwODI0MTAxOTUwWhcNMTYxMTE2MTAxMDAw
WjBmMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEVMBMGA1UEAwwMKi5n
b29nbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyLctB7lK
zwvBkXv2ER7HXp4rEqre8oD2wr9VkZoVxLGar+klyqn/QIB5fJ0LmQjkjKmX9am2
79efj3KfJ+MY31Tp8Dj6s4Bq6x/QzBY5+jKvaVEcRypIt3n9H2BM2O3YQk6BGVDw
b3nIrX+//uo6yCYd/BbbOClC4YtbW32oqrN2VKjckgiewZMpcPe3i2xzFkYzM+0t
zM6m7p1XLWmywd0LPKxDTLt2DuRT/MmeQlu54V4FbGmSPwjRoAgQe6so1CaM7PJ6
+uRN0Dt2+auarfiKW+m4g+jqrEm6RjQTe3hsG8e/xAqVrrcB6NF2RyyzNPDM+oma
t/EM+W+fxsH3GQIDAQABo4IEnTCCBJkwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMIIDaQYDVR0RBIIDYDCCA1yCDCouZ29vZ2xlLmNvbYINKi5hbmRyb2lk
LmNvbYIWKi5hcHBlbmdpbmUuZ29vZ2xlLmNvbYISKi5jbG91ZC5nb29nbGUuY29t
ghYqLmdvb2dsZS1hbmFseXRpY3MuY29tggsqLmdvb2dsZS5jYYILKi5nb29nbGUu
Y2yCDiouZ29vZ2xlLmNvLmlugg4qLmdvb2dsZS5jby5qcIIOKi5nb29nbGUuY28u
dWuCDyouZ29vZ2xlLmNvbS5hcoIPKi5nb29nbGUuY29tLmF1gg8qLmdvb2dsZS5j
b20uYnKCDyouZ29vZ2xlLmNvbS5jb4IPKi5nb29nbGUuY29tLm14gg8qLmdvb2ds
ZS5jb20udHKCDyouZ29vZ2xlLmNvbS52boILKi5nb29nbGUuZGWCCyouZ29vZ2xl
LmVzggsqLmdvb2dsZS5mcoILKi5nb29nbGUuaHWCCyouZ29vZ2xlLml0ggsqLmdv
b2dsZS5ubIILKi5nb29nbGUucGyCCyouZ29vZ2xlLnB0ghIqLmdvb2dsZWFkYXBp
cy5jb22CDyouZ29vZ2xlYXBpcy5jboIUKi5nb29nbGVjb21tZXJjZS5jb22CESou
Z29vZ2xldmlkZW8uY29tggwqLmdzdGF0aWMuY26CDSouZ3N0YXRpYy5jb22CCiou
Z3Z0MS5jb22CCiouZ3Z0Mi5jb22CFCoubWV0cmljLmdzdGF0aWMuY29tggwqLnVy
Y2hpbi5jb22CECoudXJsLmdvb2dsZS5jb22CFioueW91dHViZS1ub2Nvb2tpZS5j
b22CDSoueW91dHViZS5jb22CFioueW91dHViZWVkdWNhdGlvbi5jb22CCyoueXRp
bWcuY29tghphbmRyb2lkLmNsaWVudHMuZ29vZ2xlLmNvbYILYW5kcm9pZC5jb22C
BGcuY2+CBmdvby5nbIIUZ29vZ2xlLWFuYWx5dGljcy5jb22CCmdvb2dsZS5jb22C
Emdvb2dsZWNvbW1lcmNlLmNvbYIZcG9saWN5Lm10YS1zdHMuZ29vZ2xlLmNvbYIK
dXJjaGluLmNvbYIKd3d3Lmdvby5nbIIIeW91dHUuYmWCC3lvdXR1YmUuY29tghR5
b3V0dWJlZWR1Y2F0aW9uLmNvbTBoBggrBgEFBQcBAQRcMFowKwYIKwYBBQUHMAKG
H2h0dHA6Ly9wa2kuZ29vZ2xlLmNvbS9HSUFHMi5jcnQwKwYIKwYBBQUHMAGGH2h0
dHA6Ly9jbGllbnRzMS5nb29nbGUuY29tL29jc3AwHQYDVR0OBBYEFKB/db6yKwtP
N5jOmZnvsbxhUJWnMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUSt0GFhu89mi1
dvWBtrtiGrpagS8wIQYDVR0gBBowGDAMBgorBgEEAdZ5AgUBMAgGBmeBDAECAjAw
BgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3Js
MA0GCSqGSIb3DQEBCwUAA4IBAQB9A6yyYAMgatEaBQ1dbri4avQtYEcqvgl7JQun
/LqDK7a7VL//70JJ1zuBCcwLmRAcpgqjdluWMaCyzYoXyAvciOsgoEDLQ3dlVEix
dLP7afQjSZTy7hOks3/1COlzZLDKg4wcWwl0QrqT6BRq+v197fLLnRRtGRx5GMgb
So1aqsEJAu1DLWu+ldBzpY1+wLxSYxQdZHuvUGxuFkgYbjtR7Lz/pEWdKKTbEUrX
jqn6yctD93vL4vXlDXK+ubBoEq/ObcjSCDvcEnb+jiUuqQgOIBt+SIkx7UZT4K8H
TE36uyYZX4JfnS4xyijV0DE4ckXz0hT14a9ME1x8+EhyEUSL
-----END CERTIFICATE-----
If you only want to view the certificate data you can use the following command:
echo -n | openssl s_client -connect google.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text -noout
Result of the above input:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1900029087662118664 (0x1a5e426371029708)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
Validity
Not Before: Aug 24 10:19:50 2016 GMT
Not After : Nov 16 10:10:00 2016 GMT
Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.google.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:c8:b7:2d:07:b9:4a:cf:0b:c1:91:7b:f6:11:1e:
c7:5e:9e:2b:12:aa:de:f2:80:f6:c2:bf:55:91:9a:
15:c4:b1:9a:af:e9:25:ca:a9:ff:40:80:79:7c:9d:
0b:99:08:e4:8c:a9:97:f5:a9:b6:ef:d7:9f:8f:72:
9f:27:e3:18:df:54:e9:f0:38:fa:b3:80:6a:eb:1f:
d0:cc:16:39:fa:32:af:69:51:1c:47:2a:48:b7:79:
fd:1f:60:4c:d8:ed:d8:42:4e:81:19:50:f0:6f:79:
c8:ad:7f:bf:fe:ea:3a:c8:26:1d:fc:16:db:38:29:
42:e1:8b:5b:5b:7d:a8:aa:b3:76:54:a8:dc:92:08:
9e:c1:93:29:70:f7:b7:8b:6c:73:16:46:33:33:ed:
2d:cc:ce:a6:ee:9d:57:2d:69:b2:c1:dd:0b:3c:ac:
43:4c:bb:76:0e:e4:53:fc:c9:9e:42:5b:b9:e1:5e:
05:6c:69:92:3f:08:d1:a0:08:10:7b:ab:28:d4:26:
8c:ec:f2:7a:fa:e4:4d:d0:3b:76:f9:ab:9a:ad:f8:
8a:5b:e9:b8:83:e8:ea:ac:49:ba:46:34:13:7b:78:
6c:1b:c7:bf:c4:0a:95:ae:b7:01:e8:d1:76:47:2c:
b3:34:f0:cc:fa:89:9a:b7:f1:0c:f9:6f:9f:c6:c1:
f7:19
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Subject Alternative Name:
DNS:*.google.com, DNS:*.android.com, DNS:*.appengine.google.com, DNS:*.cloud.google.com, DNS:*.google-analytics.com, DNS:*.google.ca, DNS:*.google.cl, DNS:*.google.co.in, DNS:*.google.co.jp, DNS:*.google.co.uk, DNS:*.google.com.ar, DNS:*.google.com.au, DNS:*.google.com.br, DNS:*.google.com.co, DNS:*.google.com.mx, DNS:*.google.com.tr, DNS:*.google.com.vn, DNS:*.google.de, DNS:*.google.es, DNS:*.google.fr, DNS:*.google.hu, DNS:*.google.it, DNS:*.google.nl, DNS:*.google.pl, DNS:*.google.pt, DNS:*.googleadapis.com, DNS:*.googleapis.cn, DNS:*.googlecommerce.com, DNS:*.googlevideo.com, DNS:*.gstatic.cn, DNS:*.gstatic.com, DNS:*.gvt1.com, DNS:*.gvt2.com, DNS:*.metric.gstatic.com, DNS:*.urchin.com, DNS:*.url.google.com, DNS:*.youtube-nocookie.com, DNS:*.youtube.com, DNS:*.youtubeeducation.com, DNS:*.ytimg.com, DNS:android.clients.google.com, DNS:android.com, DNS:g.co, DNS:goo.gl, DNS:google-analytics.com, DNS:google.com, DNS:googlecommerce.com, DNS:policy.mta-sts.google.com, DNS:urchin.com, DNS:www.goo.gl, DNS:youtu.be, DNS:youtube.com, DNS:youtubeeducation.com
Authority Information Access:
CA Issuers - URI:http://pki.google.com/GIAG2.crt
OCSP - URI:http://clients1.google.com/ocsp
X509v3 Subject Key Identifier:
A0:7F:75:BE:B2:2B:0B:4F:37:98:CE:99:99:EF:B1:BC:61:50:95:A7
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Authority Key Identifier:
keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.11129.2.5.1
Policy: 2.23.140.1.2.2
X509v3 CRL Distribution Points:
Full Name:
URI:http://pki.google.com/GIAG2.crl
Signature Algorithm: sha256WithRSAEncryption
7d:03:ac:b2:60:03:20:6a:d1:1a:05:0d:5d:6e:b8:b8:6a:f4:
2d:60:47:2a:be:09:7b:25:0b:a7:fc:ba:83:2b:b6:bb:54:bf:
ff:ef:42:49:d7:3b:81:09:cc:0b:99:10:1c:a6:0a:a3:76:5b:
96:31:a0:b2:cd:8a:17:c8:0b:dc:88:eb:20:a0:40:cb:43:77:
65:54:48:b1:74:b3:fb:69:f4:23:49:94:f2:ee:13:a4:b3:7f:
f5:08:e9:73:64:b0:ca:83:8c:1c:5b:09:74:42:ba:93:e8:14:
6a:fa:fd:7d:ed:f2:cb:9d:14:6d:19:1c:79:18:c8:1b:4a:8d:
5a:aa:c1:09:02:ed:43:2d:6b:be:95:d0:73:a5:8d:7e:c0:bc:
52:63:14:1d:64:7b:af:50:6c:6e:16:48:18:6e:3b:51:ec:bc:
ff:a4:45:9d:28:a4:db:11:4a:d7:8e:a9:fa:c9:cb:43:f7:7b:
cb:e2:f5:e5:0d:72:be:b9:b0:68:12:af:ce:6d:c8:d2:08:3b:
dc:12:76:fe:8e:25:2e:a9:08:0e:20:1b:7e:48:89:31:ed:46:
53:e0:af:07:4c:4d:fa:bb:26:19:5f:82:5f:9d:2e:31:ca:28:
d5:d0:31:38:72:45:f3:d2:14:f5:e1:af:4c:13:5c:7c:f8:48:
72:11:44:8b
Comments