I need to download an SSL certificate of a remote server (not HTTPS, but the SSL handshake should be the same as Google Chrome / IE / wget and curl all give certificate check fail errors) and add the certificate as trusted in my laptops Windows' certificate store since I am not able to get my IT guys to give me the CA cert.

this is for office communications so I cannot really use the actual client to get the cert.

How do I do this, I have Windows 7 and a pile of Linuxes handy so any tool / scripting language is fine.

up vote 265 down vote accepted

If you have access to OpenSSL, try

openssl s_client -connect {HOSTNAME}:{PORT} -showcerts

replacing {HOSTNAME} and {PORT} with whatever your values are.

  • 2
    I prefer this option as I don't have to open a GUI, and I can do it via SSH from our servers. – bramp Jan 23 '12 at 21:14
  • 2
    Plus it works for protocols other than HTTP. – matt Dec 3 '13 at 15:49
  • 11
    elec3647's solution fully automates extracting the PEM in a shell pipeline. – phs Dec 10 '13 at 7:05
  • 1
    443 is the default port for HTTPS. – Flimm Nov 2 '16 at 10:40
  • 1
    I needed -servername option to get the virtual host certificate. gist.github.com/Artistan/5219484efb2fe51cd064175b3d0d5971 – Artistan Jan 25 at 16:00

A quick method to get the certificate pulled and downloaded would be to run the following command which pipes the output from the -showcerts to the x509 ssl command which just strips everything extraneous off. For example:

openssl s_client -showcerts -connect server.edu:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem

To use the certificate, with wget,

wget https:/server.edu:443/somepage --ca-certificate=mycertfile.pem
  • 4
    I tried this (on another website) - but was expected the full chain of certs: seems this only brought back the first in the chain - is that to be expected? – monojohnny Aug 30 '14 at 20:42
  • 8
    That is not working for me: unable to load certificate 27262:error:0906D06C:PEM routines:PEM_read_bio:no start line:/SourceCache/OpenSSL098/OpenSSL098-50/src/crypto/pem/pem_lib.c:648:Expecting: TRUSTED CERTIFICATE – Janusz Sep 9 '14 at 9:05
  • 4
    I agree with monojohnny, this doesn't give you the full chain. – Michael Munsey Dec 2 '14 at 23:51
  • 3
    Late but @monojohnny: openssl s_client -showcerts displays all the certs in the received chain (if connection succeeds), but piping through openssl x509 takes only the first one and discards the rest. To get all of them instead use ...| sed -n '/^-----BEGIN CERT/,/^-----END CERT/p' or ...| awk '/^-----BEGIN CERT/,/^-----END CERT/' You can also use a slightly more complicated awk to put each cert in a separate file which makes them easier to use with openssl and some other tools. – dave_thompson_085 Aug 11 '16 at 21:13
  • 1
    using wget it seems to only save a index.html => HTTP request sent, awaiting response... 200 OK Length: unspecified [text/html] Saving to: ‘index.html.1’ – OZZIE Oct 25 '17 at 7:53

To be honest, I have never tried this before (never needed to) however, I have just tried in Firefox and it seems to work for saving:

  1. Click on the SSL certificate icon at the top / Padlock at the bottom.
  2. Click View Certificate
  3. Click on the Details Tab
  4. Chose which certificate you want from the hierarchy [not circled in picture]
  5. Click Export

alt text

  • Good to know - but for my curiosity, can you explain a little more what you are trying to accomplish? I have never needed to export a SSL client certificate and am very curious why you would actually have the need to do it... – William Hilsum Jan 18 '10 at 8:49
  • 1
    That's a server certificate, not a client certificate. The main reason to export a client private key & certificate is to maintain a backup, or if you want to authenticate using another browser or computer. – gbroiles Aug 17 '10 at 7:23
  • @gbroiles - read the question, he used the wrong terminology, but this solved his problem. – William Hilsum Aug 17 '10 at 9:59
  • 1
    right, and I answered your question - why would someone want to save a client certificate? "SSL client certificate" was your term, not his. – gbroiles Aug 18 '10 at 6:43
  • 1
    Doesn't look like there's a way to do this in Chrome, right?! – fatuhoku Feb 11 '16 at 16:52

Exporting a certificate using the Chrome browser

  1. Connect to the website using SSL (https://whatever)

2. Click on the lock symbol and then click on Details

  1. Since Chrome version 56, you do the following: go to the Three Dots Menu -> More Tools -> Developer Tools, then click on the Security Tab. This will give you a Security Overview with a View certificate button.

  2. Click on the View certificate button.

    A modal window will open. It has two panes. The top one shows the trust hierarchy of the site's certificate (the last one listed), the intermediate certificate(s), and the root certificate (the topmost one).

    The second, larger pane, shows the details of one of the certificates.

    There may be zero or more intermediate certificates.

    Note that the root certificate has a gold-bordered icon. The others have a blue border.

    See the screen shot below.

  3. To export a certificate:

    1. First click on the certificate's icon in the trust hierarchy.
    2. The certificate will be shown in the main part of the modal.
    3. Click on the certificate's large icon in the main part of the modal. Drag the icon to your desktop. Chrome will then copy the certificate to your desktop.

enter image description here

  • I had to drag the icon onto a text editor, desktop didn't work for me. – Cory Klein May 4 '17 at 19:23
  • 2
    For Chrome on Windows, after you click 'View certificate' the modal is different than Mac. Click the Details tab and then Copy to File...Then choose the format and filename, which is straightforward. – PolyTekPatrick Aug 30 '17 at 12:06
  • When I use Chrome v63 on Mac OS, the text file I get from dragging the certificate is human-readable, but not in any structured format that I can figure out how to convert into machine-readable form like X.509 .crt . – Jim DeLaHunt Dec 19 '17 at 2:06
  • no difference if opening from address bar or from this dev tab, and still can't download crt... – user25 Mar 31 at 0:32

This is gbroiles' answer, but I wanted to point out that the cURL project has a page with a few more details on using openssl to save the remote server's SSL certificate:

  • openssl s_client -connect {HOSTNAME}:{PORT} | tee logfile
  • Type QUIT and press the Enter / Return key.
  • The certificate will be listed between "BEGIN CERTIFICATE" and "END CERTIFICATE" markers.
  • If you want to see the data in the certificate, you can use:

    openssl x509 -inform PEM -in certfile -text -out certdata

    where certfile is the certificate extracted from logfile. Look in certdata.

  • This worked for me. To be a bit more explicit, I edited logfile and trimmed everything that was outside of the BEGIN CERTIFICATE and END CERTIFICATE and saved the result as certfile.pem (Not sure if the extension was necessary). – Michael Welch Oct 25 at 19:52

automated

-servername was required for me to get the right cert from the virtual host on our server.

openssl s_client -showcerts -connect host.name.com:443 -servername host.name.com </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > host.name.com.pem

you may also convert to a certificate for desktop

openssl x509 -inform PEM -in host.name.com.pem -outform DER -out host.name.com.cer

last part is to add it to your certs, not sure on windows
for mac keychain I used, should be similar...

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain host.name.com.cer

This will give the results containing the certificates only

echo QUIT | \
openssl s_client -showcerts -connect hostname:port | \
awk '/-----BEGIN CERTIFICATE-----/ {p=1}; p; /-----END CERTIFICATE-----/ {p=0}' "

protected by Community Aug 24 '16 at 13:54

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.