Complete Guide to Retrieving Server Certificates Using OpenSSL

OpenSSL s_client Command Fundamentals

OpenSSL s_client is a powerful command-line tool for establishing SSL/TLS connections and retrieving server certificate information. In standard HTTPS connection scenarios, the basic connection command format is:

openssl s_client -connect host:port

This command establishes an SSL connection to the specified host and port, displaying the server's certificate information during the connection process. However, in certain specially configured server environments, using only basic parameters may not successfully complete the SSL handshake.

Certificate Retrieval in Client Authentication Scenarios

When the target server is configured with client certificate authentication, standard s_client commands may encounter SSL handshake failures. In such cases, it's necessary to provide the client's private key and certificate to complete the mutual authentication process.

The correct command format should include parameters required for client authentication:

openssl s_client -connect host:port -key client_private_key.pem -showcerts -cert client_certificate.pem

In this command, the -key parameter specifies the client's private key file, and the -cert parameter specifies the client's certificate file. Together, these two parameters form the foundation of client authentication.

Parameter Detailed Analysis

The -connect parameter specifies the target server address and port number to connect to. This is fundamental for establishing SSL connections and must be configured correctly.

The -key parameter is used to specify the client's private key file. Private key files are typically stored in .pem format and contain the client's encryption key information. During client authentication, the private key is used to generate digital signatures, proving the client's ownership of the corresponding certificate.

The -cert parameter specifies the client's certificate file. This certificate must correspond to the private key file and is typically issued by a certificate authority trusted by the server. The certificate file contains the client's identity information and public key.

The -showcerts parameter instructs s_client to display complete certificate chain information. This parameter is particularly useful when needing to obtain the server's complete certificate trust chain.

Practical Application Examples

Assume we need to connect to a server requiring client authentication, with server address secure.example.com, port 443. The client private key file is client_key.pem, and the client certificate file is client_cert.pem.

The complete command is as follows:

openssl s_client -connect secure.example.com:443 -key client_key.pem -showcerts -cert client_cert.pem

After executing this command, OpenSSL will:

1. Establish a TCP connection to secure.example.com:443
2. Initiate the SSL handshake process
3. Complete client authentication using the provided client certificate and private key
4. Display the server's certificate information (including the complete certificate chain)

Common Issues and Solutions

During the process of retrieving server certificates, various SSL handshake errors may be encountered. Here are some common issues and their solutions:

Error: SSL handshake failure

This typically indicates a problem during the SSL handshake process. Possible causes include:

• Server requires client certificate but none was provided
• Provided client certificate is not trusted by the server
• Certificate and private key do not match
• Protocol version incompatibility

The solution is to ensure proper configuration of client certificate and private key, and verify certificate validity.

Certificate Format Processing

Retrieved certificates are typically displayed in PEM format, enclosed between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. These contents can be directly saved to files for subsequent certificate management operations.

For example, to save the retrieved certificate to a file:

openssl s_client -connect host:port -key key.pem -cert cert.pem 2>/dev/null | sed -n '/^-.*BEGIN/,/^-.*END/p' > server_cert.pem

Advanced Application Scenarios

In certain complex network environments, additional parameter configurations may be necessary:

For servers using SNI (Server Name Indication), the -servername parameter needs to be added:

openssl s_client -connect host:port -servername example.com -key key.pem -cert cert.pem

For scenarios requiring specific SSL protocol versions, parameters like -ssl3, -tls1, -tls1_1, -tls1_2 can be used to specify the protocol version.

Security Considerations

When using OpenSSL to retrieve server certificates, the following security considerations should be noted:

• Properly safeguard client private key files to avoid leakage
• Regularly update client certificates to ensure they remain valid
• Verify server certificate validity to prevent man-in-the-middle attacks
• Use secure certificate storage solutions in production environments

Conclusion

By properly configuring OpenSSL s_client command parameters, particularly providing appropriate -key and -cert parameters when servers require client authentication, server certificate information can be successfully retrieved. This approach not only resolves SSL handshake failure issues but also provides reliable solutions for complex certificate management scenarios.