How to utilize openssl in Linux to check SSL certificate details

Image: Getty Images/iStockphoto

Administering SSL certificates tin beryllium rather a chore, particularly erstwhile it comes clip to renew oregon regenerate them. Expiring SSL certificates tin beryllium devastating for technological operations, with the interaction ranging from worrisome browser mistake messages to implicit accumulation outages. Therefore, it's important to not lone support an oculus connected upcoming SSL certificate expirations (network scans oregon astatine the precise slightest a log keeping way of these certificates are essential) but to wholly verify the occurrence of renewing/replacing these certificates.

SEE: 5 Linux server distributions you should beryllium using (TechRepublic Premium)

Certificate files successful Linux are mostly successful the /etc/pki/tls/certs folder oregon perchance wrong an application-specific folder specified arsenic /etc/httpd for Apache (depending connected the whim of the idiosyncratic oregon vendor who configured/built the application). These mostly usage .pem oregon .crt extensions and volition apt beryllium named '(hostname).pem' '(hostname).crt', but sometimes the generic "server" record sanction is utilized arsenic well.

The openssl bid is simply a veritable Swiss Army weapon of functions you tin usage to administer your certificates. To illustration the details of a peculiar certificate, tally the pursuing command:

openssl x509 -in (path to certificate and certificate filename) -text -noout

You volition spot output akin to the following. The Issuer, Subject, Not Before/Note After and Subject Alternative Names fields volition person the astir utile details:

It's besides arsenic utile to tally a cheque against the larboard associated with an SSL certificate (e.g., 443 for a web server). You tin tally this bid to cheque the expiration day of a certificate. I highly urge moving this earlier and aft replacing oregon renewing an SSL certificate to corroborate success. Note that erstwhile replacing exertion related certificates (such arsenic for Apache) you'll apt request to restart the exertion oregon it to prime up the caller certificate.

Either usage this bid connected the big strategy itself oregon tally it remotely against that system, substituting for "localhost" the afloat qualified domain sanction (FQDN) of the big you privation to cheque and changing the larboard 443 arsenic needed to lucifer the unfastened larboard associated with the SSL certificate.

openssl s_client -connect localhost:443 2>/dev/null | openssl x509 -noout -dates

You should person output akin to the following:

Not Before: Mar 19 15:32:02 2021 GMT
Not After : Mar 19 15:42:02 2022 GMT  

This publication beneath tin besides beryllium utilized to extrapolate adjacent much details astir a certificate and arsenic supra tin beryllium utilized locally oregon remotely. 

I telephone it ssl_validate.sh, but you tin transcript the contents into a caller publication record with immoderate sanction you like, usage chmod +x to marque it executable, and past usage it with the pursuing syntax:

./ssl_validate.sh (or whichever publication sanction you choose) server.company.com:443, wherever "server.company.com" is the afloat qualified domain sanction (FQDN) of the big you privation to cheque and 443 is the larboard it's listening connected associated with the SSL certificate.

You request to guarantee you person a way to that server and larboard specified arsenic done approved firewall entries.

The publication volition instrumentality output akin to the pursuing to show the astir salient details of the SSL certificate:

server.company.com:443  ;  SSL  ;  CN: (CN of the SSL certificate) ;  Subject (Subject of the SSL certificate)  ;  Issuer: (Issuer of the SSL certificate)   ;  notBefore: (Creation day of the SSL certificate) ;  notAfter: (Expiration day of the SSL certificate)  ;  DaysUntilExpiration: (Days remaining until the SSL certificate expires)  ;  Errors:  (Any related errors with the SSL certificate)

The publication starts below:

delim=" ; "

export delim

serverport=${1}

export serverport

echo "#${serverport}"

date_today=$(date +%F)

datediff() {

    d1=$(date -d "$1" +%s)

    d2=$(date -d "$2" +%s)

    echo $(( (d1 - d2) / 86400 )) days

}

export -f datediff

sslscan() {

        section sp=${1}

tls_content=$(echo "Q" | openssl s_client -showcerts -connect ${serverport} 2>&1)

        if [[ "$?" == 0 ]]; then

                tls_errors=$(echo "${tls_content}" | grep -i mistake )

                tls_cert_subject=$(echo "${tls_content}" | openssl x509 -noout -subject )

                tls_cert_issuer=$(echo "${tls_content}" | openssl x509 -noout -issuer )

                tls_cert_cn=$(echo "${tls_content}" | openssl x509 -noout -subject | sed -e "s/.*CN=\([^\/]*\).*/\1/" )

                tls_cert_dates=$(echo "${tls_content}" | openssl x509 -noout -dates )

                tls_cert_notafter_date=$(echo "${tls_cert_dates}" | grep notAfter |sed -e "s/notAfter=//" | tr -d '\n')

                tls_cert_notbefore_date=$(echo "${tls_cert_dates}" | grep notBefor |sed -e "s/notBefore=//" | tr -d '\n')

                tls_cert_datediff=$(datediff "${tls_cert_notafter_date}" "${date_today}")

                echo -n "${serverport} ${delim} SSL"

                echo -n " ${delim} CN:"

                echo -n " ${tls_cert_cn}"

                echo -n " ${delim} Subject:"

                echo -n " ${tls_cert_subject}"

                echo -n " ${delim} Issuer:"

                echo -n " ${tls_cert_issuer}"

                echo -n " ${delim} notBefore:"

                echo -n " ${tls_cert_notbefore_date}"

                echo -n " ${delim} notAfter:"

                echo -n " ${tls_cert_notafter_date}"

                echo -n " ${delim} DaysUntilExpiration:"

                echo -n " ${tls_cert_datediff}"

                echo -n " ${delim} Errors:"

                echo -n " ${tls_errors}"

                echo

        else

                tls_errors=$(echo "${tls_content}" | tr '\n' '/' | tr ' ' '_' )

                status="ERROR: ${tls_errors}"

                echo -n "${serverport} ${delim} ${status}"

                echo

        fi

}

export -f sslscan

timeout 3 bash -c "sslscan ${serverport}"

if [[ $? != 0 ]]; then

        echo -n "${serverport} ${delim} ERROR: CONNECTION_TIMED_OUT"

        echo

fi

Also see

• 3 reasons to commencement utilizing SSL certificates close now (TechRepublic)
• Linux turns 30: Celebrating the unfastened root operating strategy (free PDF) (TechRepublic)
• Windows, Linux, and Mac commands everyone needs to cognize (free PDF) (TechRepublic)
• How to go a developer: A cheat sheet (TechRepublic)
• Best practices for Linux admins (TechRepublic Premium)
• From commencement to finish: How to deploy an LDAP server (TechRepublic Premium)
• Linux, Android, and much unfastened root tech coverage (TechRepublic connected Flipboard)