使用openssl从服务器获取证书 [英] Using openssl to get the certificate from a server
问题描述
我试图获取远程服务器的证书,然后我可以使用它添加到我的密钥库并在我的java应用程序中使用。
I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my java application.
(谁在节假日:()告诉我我可以运行这个:
A senior dev (who is on holidays :( ) informed me I can run this:
openssl s_client -connect host.host:9999
要获得原始证书,我可以复制和导出,我收到以下输出: / p>
To get a raw certificate dumped out, which I can then copy and export. I receive the following output:
depth=1 /C=NZ/ST=Test State or Province/O=Organization Name/OU=Organizational Unit Name/CN=Test CA
verify error:num=19:self signed certificate in certificate chain
verify return:0
23177:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
23177:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:
我也尝试过这个选项
-showcerts
和这一个(在debian心目中运行)
and this one (running on debian mind you)
-CApath /etc/ssl/certs/
错误。
此来源表示我可以使用CApath标志,但它似乎并没有帮助。我尝试了多个路径无效。
This source says I can use that CApath flag but it doesn't seem to help. I tried multiple paths to no avail.
请让我知道我在哪里出错。
Please let me know where I'm going wrong.
推荐答案
原来,这里有更多的复杂性:我需要提供更多的细节来滚动。我认为它的事情,它的一个连接,需要客户端认证,和hankshake需要更多的信息,继续到证书被转储的阶段。
It turns out there is more complexity here: I needed to provide many more details to get this rolling. I think its something to do with the fact that its a connection that needs client authentication, and the hankshake needed more info to continue to the stage where the certificates were dumped.
这是我的工作命令:
openssl s_client -connect host:port -key our_private_key.pem -showcerts \
-cert our_server-signed_cert.pem
希望这是一个向正确的方向微调,与一些更多的信息。
Hopefully this is a nudge in the right direction for anyone who could do with some more info.
这篇关于使用openssl从服务器获取证书的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!