Wget or curl a self-signed certificate from server

Question

From my browser, I can browse to a machine in my companies local intranet and (after marking the certificate as trusted) export that certificate to a file. I'm trying to automate this process into a shellscript so I can make my life a little easier when using various commandline tools without throwing security out the window.

Trying to google this topic has been difficult and has mainly yielded results about how to trust a certificate you have already downloaded while using wget or curl, but that's not what I need in this case. How can I download the server's public self-signed certificate to a local file via wget or curl?

Solution

I'm not sure about wget or curl, but the following works if you are only concerned about the public key.

openssl s_client -connect hostname.domain.tld:port 2>&1 </dev/null | sed -ne '/BEGIN CERT/,/END CERT/p'

Generally when they are talking about downloading the certificate, it would be the root certificate. You can find the one for Verisign with the following command, then wget or curl the root cert on to your system to authenticate with Verisign certificates. In this case, it's specifically the "VeriSign Class 3 Extended Validation SSL SGC CA" Root.

$ openssl s_client -connect verisign.com:443 2>&1 </dev/null | openssl x509 -noout -text | grep "CA Issuers"
            CA Issuers - URI:http://EVIntl-aia.verisign.com/EVIntl2006.cer

The above command should work for nearly any server displaying a chained certificate.

Comments

[derobert]

BTW: Your company ought to generate its own CA, then use that to sign all its internal certificates. You then install only that CA's public key on your machine, not a self-signed cert for each server.

[Paul FREAKN Baker]

Thanks for the tip, I'll try to pass it along but those in charge may not care enough to actually do anything about it

[Paul FREAKN Baker]

That works perfectly. There is a small typo, sed is missing a - before the ne options but that works and is exactly what I need. Thank you.

[Falsenames]

Fixed the typo. It was correct in the latter one. Sorry about that, but glad it worked out in the end.