使用 openssl 从服务器获取证书 [英] Using openssl to get the certificate from a server

问题描述

我正在尝试获取远程服务器的证书，然后我可以将其添加到我的密钥库并在我的 Java 应用程序中使用.

I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my Java application.

一位高级开发人员(正在度假:() 告诉我我可以运行这个:

A senior dev (who is on holidays :( ) informed me I can run this:

openssl s_client -connect host.host:9999

获取转储的原始证书，然后我可以复制和导出.我收到以下输出:

to get a raw certificate dumped out, which I can then copy and export. I receive the following output:

depth=1 /C=NZ/ST=Test State or Province/O=Organization Name/OU=Organizational Unit Name/CN=Test CA
verify error:num=19:self signed certificate in certificate chain
verify return:0
23177:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
23177:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

我也用这个选项试过了:

I have also tried it with this option:

-showcerts

还有这个(请注意在 Debian 上运行):

and this one (running on Debian mind you):

-CApath /etc/ssl/certs/

但我得到了同样的错误.

But I get the same error.

这个来源 说我可以使用那个 CApath 标志，但它没有似乎有帮助.我尝试了多种路径都无济于事.

This source says I can use that CApath flag but it doesn't seem to help. I tried multiple paths to no avail.

请告诉我哪里出错了.

推荐答案

事实证明这里有更多的复杂性:我需要提供更多细节来实现这一点.我认为这与它的连接需要客户端身份验证有关，而 hankshake 需要更多信息才能继续转储证书的阶段.

It turns out there is more complexity here: I needed to provide many more details to get this rolling. I think its something to do with the fact that its a connection that needs client authentication, and the hankshake needed more info to continue to the stage where the certificates were dumped.

这是我的工作命令:

openssl s_client -connect host:port -key our_private_key.pem -showcerts 
                 -cert our_server-signed_cert.pem

希望这对任何可以了解更多信息的人来说都是朝着正确方向迈进的一步.

Hopefully this is a nudge in the right direction for anyone who could do with some more info.

这篇关于使用 openssl 从服务器获取证书的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！