Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose that a website returns an invalid certificate, for which Firefox and Chrome give the user scary warnings. I would like to ensure that my local connection is not being man-in-the-middled (which is a real possibility in this case) so I would like to check the certificate from a remote server in another nation via SSH. How can this be done?

I did try simply opening the site in question with elinks but elinks apparently does not throw the same scary message for invalid certificates.

share|improve this question
up vote 1 down vote accepted

First obtain the certificate using either gnutls-cli or openssl s_client.

gnutls-cli "$host" -p "$port" --insecure --print-cert < /dev/null > cert

openssl s_client -connect "$host:$port" -no_ign_eof < /dev/null > cert

Then dump all certificate information (usually lists at least two certificates, the server's and the CA's):

certtool -i < cert

while openssl x509 -text; do true; done < cert

Or just the SHA1 fingerprint of the topmost certificate:

certtool -i < cert | grep -A1 fingerprint

openssl x509 -noout -fingerprint -sha1 < cert
share|improve this answer
Thanks. I'm having trouble with gnutls, so I asked on unix.SE. I'll get back to your very detailed answer as soon as I've got the issues with gnutls sorted. Thank you Grawity! – dotancohen Jan 23 '13 at 19:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.