View and Export a remote server/host certificate chain using OpenSSL

-


Command to view the certificate of the remote host: 


 openssl s_client -host vcd.vcloud.local -port 443 -prexit -showcerts

The sample output : 

[root@vcd91 logs]# openssl s_client -host vcd.vcloud.local -port 443 -prexit -showcerts
CONNECTED(00000003)
depth=0 CN = localhost
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = localhost
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 CN=localhost
 CN=localhost
-----BEGIN CERTIFICATE-----
MIIDJzCCAg+gAwIBAgIIGCO6ARMqzPcwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UE
AxMJbG9jYWxob3N0MB4XDTE4MDQxMjE2MjYxNFoXDTE5MDQxMjE2MjYxNFowFDES
MBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAqH8MhOvLYUXi9KnbykTclmMFMWyJsHH5mDu7uJBOF8flWIxBmyGjAseGYkw9
6D0zmEqJCseC0u1oNXyb1HH1rWHtwUmCtOwg/dVIOSaTVet8DjbhgjoTSU31lMll
.
.
.
.
.
.

zYpAgY6lonBKyjDUiRp//XkXiZjLyJZQfRXYEjrFt79EJ8/boQllFhHJlJaBGxt7
RoQTgc20b2gqalSwypb+xRhJeMYO7ZGEokNzq19FjDWKfog+Mt+OaDhpia29MR/2
An86du7h4oApMv4SlsOKw1dZ9Agv4vp68NN+3EZ8M9eAhjGIWlqBEnMSpmrNuPOx
NI6cdCzo3iPNgFlEYbehLttxziak1GNzCyehf0xCffia5rb/JZGcnM1CNPSIKFHK
puaHXKqEAGXvXC1WoYem21B6TsYg1FE+fHRLcm4HS0Mu2z4zgkq2dCujjA==
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=localhost
issuer=/CN=localhost
---
No client certificate CA names sent
---
SSL handshake has read 986 bytes and written 631 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA
    Session-ID: 5C9AE4DB020DBFDCA5091C2E34179A5CBF93BC829A60AC0F52551E3DDA1CAEA5
    Session-ID-ctx:
    Master-Key: 8A72DA9FCB1580033DFB35ABDBAEBB33AC73DCDCD43312EAB9DE47929696CAA48DA8526530E61B8B35DBC9775557F921
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1553655003
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---

---
Certificate chain
 0 s:/CN=localhost
   i:/CN=localhost
-----BEGIN CERTIFICATE-----
MIIDJzCCAg+gAwIBAgIIGCO6ARMqzPcwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UE
AxMJbG9jYWxob3N0MB4XDTE4MDQxMjE2MjYxNFoXDTE5MDQxMjE2MjYxNFowFDES
MBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAqH8MhOvLYUXi9KnbykTclmMFMWyJsHH5mDu7uJBOF8flWIxBmyGjAseGYkw9
6D0zmEqJCseC0u1oNXyb1HH1rWHtwUmCtOwg/dVIOSaTVet8DjbhgjoTSU31lMll
.
.
.
.
.
.

An86du7h4oApMv4SlsOKw1dZ9Agv4vp68NN+3EZ8M9eAhjGIWlqBEnMSpmrNuPOx
NI6cdCzo3iPNgFlEYbehLttxziak1GNzCyehf0xCffia5rb/JZGcnM1CNPSIKFHK
puaHXKqEAGXvXC1WoYem21B6TsYg1FE+fHRLcm4HS0Mu2z4zgkq2dCujjA==
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=localhost
issuer=/CN=localhost
---
No client certificate CA names sent
---
SSL handshake has read 1039 bytes and written 684 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA
    Session-ID: 5C9AE4DB020DBFDCA5091C2E34179A5CBF93BC829A60AC0F52551E3DDA1CAEA5
    Session-ID-ctx:
    Master-Key: 8A72DA9FCB1580033DFB35ABDBAEBB33AC73DCDCD43312EAB9DE47929696CAA48DA8526530E61B8B35DBC9775557F921
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1553655003
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---

Command to view the certificate of the remote host: 

echo -n | openssl s_client -showcerts -connect vcd.vcloud.local:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/cert.pem

The above command will create a .PEM file in /tmp directory named cert.pem which will include the complete certificate chain of the remote host. 



Good luck! Cheers :) 






Comments

Post a Comment

Popular posts from this blog

vCloud director 9.7 appliance deployment step by step guide

-
Image
With the new vCloud director releasing and making it full appliance with embedded vpostgres, I though I will put up a post with the complete installation guide. There have been some challenges in the getting the deployment successful. Prerequisite : Reverse DNS proxy must be configured for the eth0 ipaddress. This is to get the correct hostname for the appliance.  The NFS share is setup for the VCD transfer directory. It is recommended to have the eth0 and eth1 in different subnets. eth0 is for the vcd cell and eth1 is for the vPostgres .The reason for the having 2 subnets is to avoid duplicate entries in the route table.  Installing vCloud director step by step guide :  I should ideally be using different submets as per the VMware documentation but since I do not have a different portgroup setup, I am going with the same subnet.  As mentioned in the prereq section, the reason for the having 2 subnets is to avoid duplicate entries in the route tab
Read more

How to Install and Uninstall Guest agent for vRA Windows machines

-
Image
Connect to the vRA appliance using the IP or hostname  Choose the appropriate setup for your Windows server  Extract the files to C:\VRMGuestAgent\ . In my case, I have already extracted it.  Before you install the guest agent download and install the IAAS manager server certificate into the windows machine  Save the file as Cert.cer  Install the Cert into the Local machine and Trusted root store Rename the cert.cer to cert.pem and move it to folder C:\VRMGuestAgent\ Now, copy the certificate file into the vRMGuestAgent Extracted folder  Open the command prompt as admin and navigate to C:\VRMGuestAgent. In this case 192.168.2.15 is my Manager server . The default port is 443.  You will see the Guest agent service in the services list. Manually start the service.  Your windows guest agent is installed :)  How to Uninstall Guest agent on windows machine  To uninsta
Read more

VM console fails to connect - vCloud director 9.7

-
Image
I deployed a new vCloud director 9.7 and the VM console fails to connect even though the certificates and URLs are updated correctly in Public Addresses. The chrome browser console (ctrl+shift+j) fails like below :  failed: Error during WebSocket handshake: Unexpected response code: 404 After reading the VMware documentation which says " For an installation with a single IP address, you can customize the console proxy address from the  vCloud Director  Web Console. For example, for the  vCloud Director  appliance, you must customize the console proxy address to  vcloud.example.com :8443 " From vCloud director 9.7, the second network (eth1) is dedicated to vpostgres database and console proxy uses (eth0) with a custom port 8443 Fix :  Update the console proxy address with custom port 8443 under vCD portal --> Administrator --> Public addresses Tadaa!  Thanks for reading. Hope it helps :) 
Read more