Grabbing an SSL certificate from a remote server

There are moments when you need to inspect the certificate a remote server is presenting – maybe it’s expired and you’re trying to work out why things are breaking, or maybe you need the raw certificate data for some other reason and don’t have access to the server’s configuration.

The quickest way is with openssl s_client:

openssl s_client -connect {HOSTNAME}:{PORT} -showcerts

Replace {HOSTNAME} with the server address and {PORT} with the port (usually 443 for HTTPS). The -showcerts flag dumps the full certificate chain rather than just the leaf certificate.

If you only want the certificate itself without all the connection handshake noise, pipe it through sed to strip everything except the PEM block:

openssl s_client -connect {HOSTNAME}:{PORT} -showcerts 2>/dev/null | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p'

That gives you a clean certificate you can save to a file or inspect further. Useful trick to have in your back pocket.