Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Suppose that a website returns an invalid certificate, for which Firefox and Chrome give the user scary warnings. I would like to ensure that my local connection is not being man-in-the-middled (which is a real possibility in this case) so I would like to check the certificate from a remote server in another nation via SSH. How can this be done?

I did try simply opening the site in question with elinks but elinks apparently does not throw the same scary message for invalid certificates.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

First obtain the certificate using either gnutls-cli or openssl s_client.

gnutls-cli "$host" -p "$port" --insecure --print-cert < /dev/null > cert

openssl s_client -connect "$host:$port" -no_ign_eof < /dev/null > cert

Then dump all certificate information (usually lists at least two certificates, the server's and the CA's):

certtool -i < cert

while openssl x509 -text; do true; done < cert

Or just the SHA1 fingerprint of the topmost certificate:

certtool -i < cert | grep -A1 fingerprint

openssl x509 -noout -fingerprint -sha1 < cert
share|improve this answer
    
Thanks. I'm having trouble with gnutls, so I asked on unix.SE. I'll get back to your very detailed answer as soon as I've got the issues with gnutls sorted. Thank you Grawity! –  dotancohen Jan 23 '13 at 19:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.