Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to download an SSL certificate of a remote server (not HTTPS, but the SSL handshake should be the same as Google Chrome / IE / wget and curl all give certificate check fail errors) and add the certificate as trusted in my laptops Windows' certificate store since I am not able to get my IT guys to give me the CA cert.

this is for office commnunicator so I cannot really use the actual client to get the cert.

How do I do this, I have Windows 7 and a pile of Linuxes handy so any tool / scripting language is fine.

share|improve this question

4 Answers 4

up vote 47 down vote accepted

If you have access to OpenSSL, try

openssl s_client -connect {HOSTNAME}:{PORT} -showcerts

replacing {HOSTNAME} and {PORT} with whatever your values are.

share|improve this answer
2  
I prefer this option as I don't have to open a GUI, and I can do it via SSH from our servers. –  bramp Jan 23 '12 at 21:14
2  
Plus it works for protocols other than HTTP. –  lucek Dec 3 '13 at 15:49
2  
elec3647's solution fully automates extracting the PEM in a shell pipeline. –  phs Dec 10 '13 at 7:05

To be honest, I have never tried this before (never needed to) however, I have just tried in Firefox and it seems to work for saving:

  1. Click on the SSL certificate icon at the top / Padlock at the bottom.
  2. Click View Certificate
  3. Click on the Details Tab
  4. Chose which certificate you want from the hierarchy [not circled in picture]
  5. Click Export

alt text

share|improve this answer
    
worked like a charm, thanks –  Kimvais Jan 18 '10 at 8:43
    
Good to know - but for my curiosity, can you explain a little more what you are trying to accomplish? I have never needed to export a SSL client certificate and am very curious why you would actually have the need to do it... –  William Hilsum Jan 18 '10 at 8:49
    
That's a server certificate, not a client certificate. The main reason to export a client private key & certificate is to maintain a backup, or if you want to authenticate using another browser or computer. –  gbroiles Aug 17 '10 at 7:23
    
@gbroiles - read the question, he used the wrong terminology, but this solved his problem. –  William Hilsum Aug 17 '10 at 9:59
    
right, and I answered your question - why would someone want to save a client certificate? "SSL client certificate" was your term, not his. –  gbroiles Aug 18 '10 at 6:43

A quick method to get the certificate pulled and downloaded would be to run the following command which pipes the output from the -showcerts to the x509 ssl command which just strips everything extraneous off. For example:

openssl s_client -showcerts -connect server.edu:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem
share|improve this answer

This is gbroiles' answer, but I wanted to point out that the cURL project has a page with a few more details on using openssl to save the remote server's SSL certificate:

  • openssl s_client -connect {HOSTNAME}:{PORT} | tee logfile
  • Type QUIT and press the Enter / Return key.
  • The certificate will be listed between "BEGIN CERTIFICATE" and "END CERTIFICATE" markers.
  • If you want to see the data in the certificate, you can use:

    openssl x509 -inform PEM -in certfile -text -out certdata

    where certfile is the certificate extracted from logfile. Look in certdata.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.