Secure Sockets Layer and Transport Layer Security certificates are foundational to modern web security, establishing encrypted tunnels between servers and clients. When managing infrastructure, you often need to retrieve a certificate from a remote server to inspect its details, verify its issuer, or troubleshoot an integration. The openssl command line provides a direct method to perform an openssl certificate download without relying on graphical browsers.
Using OpenSSL to Retrieve Remote Certificates
The most common approach to download a certificate in PEM format leverages the s_client command inside the OpenSSL suite. By connecting to a service on its standard port and extracting the certificate chain, you can save the output to a file for later analysis. This technique works for HTTPS sites, SMTP on port 587, or any TCP service that speaks TLS.
Command Structure for Downloading
To execute the download, you connect and immediately close the connection while saving the raw certificate data. The following pipeline retrieves the certificate and converts it into a readable PEM format suitable for use in other tools.
The first command extracts the leaf certificate and converts it to PEM, while the second option preserves the entire certificate chain. This flexibility ensures you capture exactly the data you need for compliance or debugging.
Inspecting and Verifying Downloaded Certificates
Once the file is saved locally, you can analyze its contents to verify the subject, validity dates, and public key information. Inspecting the details helps confirm that the correct certificate was retrieved and that it has not expired.
Viewing Certificate Details
Use the x509 subcommand to parse the PEM file and display human readable fields. This step reveals the Common Name, Organization, and Extended Key Usage extensions embedded in the certificate.
openssl x509 -in example.pem -text -noout
For quick validation of the modulus or fingerprint, you can compare these values against data from a Certificate Authority or internal registry to ensure consistency.
Downloading Certificates in Different Encodings
OpenSSL allows you to choose between PEM, DER, and text outputs depending on the destination system. PEM is base64 encoded and works with most web servers and configuration files, while DER is binary and often used in Java keystores or Windows systems.
Converting Between Formats
If you initially download a certificate in PEM and need DER, or vice versa, OpenSSL can convert the format without losing data. This capability is essential when integrating with platforms that require a specific encoding.
These commands preserve the full structure of the certificate, including extensions and signature details, ensuring the converted file remains valid.
