Using openssl to get the certificate from a server
certificate, linux, openssl, security, ssl-certificate
Solution
It turns out there is more complexity here: I needed to provide many more details to get this rolling. I think its something to do with the fact that its a connection that needs client authentication, and the hankshake needed more info to continue to the stage where the certificates were dumped.
Here is my working command:
openssl s_client -connect host:port -key our_private_key.pem -showcerts \
-cert our_server-signed_cert.pem
Hopefully this is a nudge in the right direction for anyone who could do with some more info.
Problem
I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my Java application. A senior dev (who is on holidays :( ) informed me I can run this: ``` openssl s_client -connect host.host:9999 ``` to get a raw certificate dumped out, which I can then copy and export. I receive the following output: ``` depth=1 /C=NZ/ST=Test State or Province/O=Organization Name/OU=Organizational Unit Name/CN=Test CA verify error:num=19:self signed certificate in certificate chain verify return:0 23177:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40 23177:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: ``` I have also tried it with this option: ``` -showcerts ``` and this one (running on Debian mind you): ``` -CApath /etc/ssl/certs/ ``` But I get the same error. This source says I can use that CApath flag but it doesn't seem to help. I tried multiple paths to no avail. Please let me know where I'm going wrong.