View and Export a remote server/host certificate chain using OpenSSL

-


Command to view the certificate of the remote host: 


 openssl s_client -host vcd.vcloud.local -port 443 -prexit -showcerts

The sample output : 

[root@vcd91 logs]# openssl s_client -host vcd.vcloud.local -port 443 -prexit -showcerts
CONNECTED(00000003)
depth=0 CN = localhost
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = localhost
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 CN=localhost
 CN=localhost
-----BEGIN CERTIFICATE-----
MIIDJzCCAg+gAwIBAgIIGCO6ARMqzPcwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UE
AxMJbG9jYWxob3N0MB4XDTE4MDQxMjE2MjYxNFoXDTE5MDQxMjE2MjYxNFowFDES
MBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAqH8MhOvLYUXi9KnbykTclmMFMWyJsHH5mDu7uJBOF8flWIxBmyGjAseGYkw9
6D0zmEqJCseC0u1oNXyb1HH1rWHtwUmCtOwg/dVIOSaTVet8DjbhgjoTSU31lMll
.
.
.
.
.
.

zYpAgY6lonBKyjDUiRp//XkXiZjLyJZQfRXYEjrFt79EJ8/boQllFhHJlJaBGxt7
RoQTgc20b2gqalSwypb+xRhJeMYO7ZGEokNzq19FjDWKfog+Mt+OaDhpia29MR/2
An86du7h4oApMv4SlsOKw1dZ9Agv4vp68NN+3EZ8M9eAhjGIWlqBEnMSpmrNuPOx
NI6cdCzo3iPNgFlEYbehLttxziak1GNzCyehf0xCffia5rb/JZGcnM1CNPSIKFHK
puaHXKqEAGXvXC1WoYem21B6TsYg1FE+fHRLcm4HS0Mu2z4zgkq2dCujjA==
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=localhost
issuer=/CN=localhost
---
No client certificate CA names sent
---
SSL handshake has read 986 bytes and written 631 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA
    Session-ID: 5C9AE4DB020DBFDCA5091C2E34179A5CBF93BC829A60AC0F52551E3DDA1CAEA5
    Session-ID-ctx:
    Master-Key: 8A72DA9FCB1580033DFB35ABDBAEBB33AC73DCDCD43312EAB9DE47929696CAA48DA8526530E61B8B35DBC9775557F921
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1553655003
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---

---
Certificate chain
 0 s:/CN=localhost
   i:/CN=localhost
-----BEGIN CERTIFICATE-----
MIIDJzCCAg+gAwIBAgIIGCO6ARMqzPcwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UE
AxMJbG9jYWxob3N0MB4XDTE4MDQxMjE2MjYxNFoXDTE5MDQxMjE2MjYxNFowFDES
MBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAqH8MhOvLYUXi9KnbykTclmMFMWyJsHH5mDu7uJBOF8flWIxBmyGjAseGYkw9
6D0zmEqJCseC0u1oNXyb1HH1rWHtwUmCtOwg/dVIOSaTVet8DjbhgjoTSU31lMll
.
.
.
.
.
.

An86du7h4oApMv4SlsOKw1dZ9Agv4vp68NN+3EZ8M9eAhjGIWlqBEnMSpmrNuPOx
NI6cdCzo3iPNgFlEYbehLttxziak1GNzCyehf0xCffia5rb/JZGcnM1CNPSIKFHK
puaHXKqEAGXvXC1WoYem21B6TsYg1FE+fHRLcm4HS0Mu2z4zgkq2dCujjA==
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=localhost
issuer=/CN=localhost
---
No client certificate CA names sent
---
SSL handshake has read 1039 bytes and written 684 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA
    Session-ID: 5C9AE4DB020DBFDCA5091C2E34179A5CBF93BC829A60AC0F52551E3DDA1CAEA5
    Session-ID-ctx:
    Master-Key: 8A72DA9FCB1580033DFB35ABDBAEBB33AC73DCDCD43312EAB9DE47929696CAA48DA8526530E61B8B35DBC9775557F921
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1553655003
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---

Command to view the certificate of the remote host: 

echo -n | openssl s_client -showcerts -connect vcd.vcloud.local:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/cert.pem

The above command will create a .PEM file in /tmp directory named cert.pem which will include the complete certificate chain of the remote host. 



Good luck! Cheers :) 






Comments

Post a Comment

Popular posts from this blog

vCloud director 9.7 appliance deployment step by step guide

-
Image
With the new vCloud director releasing and making it full appliance with embedded vpostgres, I though I will put up a post with the complete installation guide. There have been some challenges in the getting the deployment successful.

Prerequisite :
Reverse DNS proxy must be configured for the eth0 ipaddress. This is to get the correct hostname for the appliance. The NFS share is setup for the VCD transfer directory.It is recommended to have the eth0 and eth1 in different subnets. eth0 is for the vcd cell and eth1 is for the vPostgres .The reason for the having 2 subnets is to avoid duplicate entries in the route table. 
Installing vCloud director step by step guide : 






I should ideally be using different submets as per the VMware documentation but since I do not have a different portgroup setup, I am going with the same subnet. As mentioned in the prereq section, the reason for the having 2 subnets is to avoid duplicate entries in the route table


Here we come to the main section. The NTP …
Read more

How to Install and Uninstall Guest agent for vRA Windows machines

-
Image
Connect to the vRA appliance using the IP or hostname 




Choose the appropriate setup for your Windows server 


Extract the files to C:\VRMGuestAgent\ . In my case, I have already extracted it. 


Before you install the guest agent download and install the IAAS manager server certificate into the windows machine 



Save the file as Cert.cer 



Install the Cert into the Local machine and Trusted root store



Rename the cert.cer to cert.pem and move it to folder C:\VRMGuestAgent\


Now, copy the certificate file into the vRMGuestAgent Extracted folder 


Open the command prompt as admin and navigate to C:\VRMGuestAgent. In this case 192.168.2.15 is my Manager server . The default port is 443. 


You will see the Guest agent service in the services list. Manually start the service. 




Your windows guest agent is installed :) 

How to Uninstall Guest agent on windows machine 
To uninstall the service 
Stop the VCACGuestAgentService  Run the below command through Command Prompt as Admin   WinService…
Read more

Unable to change Provider VDC virtual hardware support beyond version 10

-
Image
My environment:

vCloud Director 9.1.0.3 and ESXi 6.5.0.

 This could happen regardless of what vCloud director and ESXi version you are on.




Provider VDC config: 


ESXi Version : 



So ideally I should be able to see the hardware version 13 in the vCloud director but I see only till version 10


Why does this happen : 

It’s most likely a user error depending on how vCenter is set up and what vCenter has reported to VCD as far as available HW versions

How to fix ? 

 From vCenter FLEX UI, go to Datacenter, right click and select 'Edit Default VM Compatibility' and there select 'ESX 6.5 and later' (This config depends on your environment)
Then go to the cluster and right click and select 'Edit Default VM Compatibility' and there the value selected would be 'Use datacenter setting and host version'. This setting would take it from datacenter setting done above.

From the vCloud director , perform and refresh of the vCenter and try to create the Provider VDC and check the…
Read more