Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to download an SSL certificate of a remote server (not HTTPS, but the SSL handshake should be the same as Google Chrome / IE / wget and curl all give certificate check fail errors) and add the certificate as trusted in my laptops Windows' certificate store since I am not able to get my IT guys to give me the CA cert.

this is for office communications so I cannot really use the actual client to get the cert.

How do I do this, I have Windows 7 and a pile of Linuxes handy so any tool / scripting language is fine.

share|improve this question
up vote 128 down vote accepted

If you have access to OpenSSL, try

openssl s_client -connect {HOSTNAME}:{PORT} -showcerts

replacing {HOSTNAME} and {PORT} with whatever your values are.

share|improve this answer
I prefer this option as I don't have to open a GUI, and I can do it via SSH from our servers. – bramp Jan 23 '12 at 21:14
Plus it works for protocols other than HTTP. – matt Dec 3 '13 at 15:49
elec3647's solution fully automates extracting the PEM in a shell pipeline. – phs Dec 10 '13 at 7:05
I had to sign in to upvote this.. :) – AttitudeMonger Dec 11 '15 at 15:10
Is there a way to get this to work behind a proxy? It doesn't seem to honor the $https_proxy environment variable. – Michael Munsey Feb 3 at 17:40

A quick method to get the certificate pulled and downloaded would be to run the following command which pipes the output from the -showcerts to the x509 ssl command which just strips everything extraneous off. For example:

openssl s_client -showcerts -connect </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem
share|improve this answer
I tried this (on another website) - but was expected the full chain of certs: seems this only brought back the first in the chain - is that to be expected? – monojohnny Aug 30 '14 at 20:42
That is not working for me: unable to load certificate 27262:error:0906D06C:PEM routines:PEM_read_bio:no start line:/SourceCache/OpenSSL098/OpenSSL098-50/src/crypto/pem/pem_lib.c:648:Expectin‌​g: TRUSTED CERTIFICATE – Janusz Sep 9 '14 at 9:05
I agree with monojohnny, this doesn't give you the full chain. – Michael Munsey Dec 2 '14 at 23:51

To be honest, I have never tried this before (never needed to) however, I have just tried in Firefox and it seems to work for saving:

  1. Click on the SSL certificate icon at the top / Padlock at the bottom.
  2. Click View Certificate
  3. Click on the Details Tab
  4. Chose which certificate you want from the hierarchy [not circled in picture]
  5. Click Export

alt text

share|improve this answer
worked like a charm, thanks – Kimvais Jan 18 '10 at 8:43
Good to know - but for my curiosity, can you explain a little more what you are trying to accomplish? I have never needed to export a SSL client certificate and am very curious why you would actually have the need to do it... – William Hilsum Jan 18 '10 at 8:49
That's a server certificate, not a client certificate. The main reason to export a client private key & certificate is to maintain a backup, or if you want to authenticate using another browser or computer. – gbroiles Aug 17 '10 at 7:23
@gbroiles - read the question, he used the wrong terminology, but this solved his problem. – William Hilsum Aug 17 '10 at 9:59
right, and I answered your question - why would someone want to save a client certificate? "SSL client certificate" was your term, not his. – gbroiles Aug 18 '10 at 6:43

This is gbroiles' answer, but I wanted to point out that the cURL project has a page with a few more details on using openssl to save the remote server's SSL certificate:

  • openssl s_client -connect {HOSTNAME}:{PORT} | tee logfile
  • Type QUIT and press the Enter / Return key.
  • The certificate will be listed between "BEGIN CERTIFICATE" and "END CERTIFICATE" markers.
  • If you want to see the data in the certificate, you can use:

    openssl x509 -inform PEM -in certfile -text -out certdata

    where certfile is the certificate extracted from logfile. Look in certdata.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.