Linux get ssl certificate

Check SSL Certificate with OpenSSL in Linux

OpenSSL is an open-source command-line tool that is commonly used to generate private keys, create CSRs, install our SSL/TLS certificate, and identify certificate information. This quick reference can help us understand the most common OpenSSL commands and how to use them.

How to get an SSL Certificate

• generate a key pair
• use this key pair to generate a certificate signing request (CSR) that contains the public key and domain name of our website
• upload the request to a certificate authority or generate a self-signed certificate
• download the certificate and install it on our web server along with the key pair

If you need a free SSL certificate for your website, Elementor Cloud Website is a great option. They offer fast speeds, good uptime, and excellent customer support. It is an end-to-end solution gives you everything you need in one place for your website. Web Hosting on Google Cloud + SSL certificate + WordPress + Website Builder + Templates.

We recommend using Elementor Cloud Website . It is very easy to start. You can get your website online in minutes. Plus, they offer a 30-day money-back guarantee, so you can try it out with no risk.

Generate Private Key and CSR

We can use the following two commands to generate private key and CSR.

Then we need to input the following info to generate CSR.

• Country Name: 2-digit country code where our organization is legally located.
• State/Province: Write the full name of the state where the organization is legally located.
• City: Write the full name of the city where our organization is legally located.
• Organization Name: Write the legal name of our organization.
• Organization Unit: Name of the department
• Common Name: Fully Qualified Domain Name

Generate Private key and CSR with one command

We can also use the following command to generate CSR and private key in a single shot.

openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key -subj “/C=US/ST=Florida/L=Saint Petersburg/O=Your Company, Inc./OU=IT/CN=yourdomain.com”

Generate a self-signed certificate

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt

Purpose of CSR file Key file and certificate file

We should use the CSR file to request our SSL certificate from a Certificate Authority. Make sure we copy the entire text.

Certificate.crt and intermediate.crt should be concatenated into a certificate file bundle and stored on the server. privateKey.key should also be stored on the server.

root.crt should be stored on the client so the client can verify that the server’s leaf certificate was signed by a chain of certificates linked to its trusted root certificate.

Check SSL certificate with OpenSSL Command

• Check Private key info: openssl rsa -text -in privateKey.key -noout
• Check CSR info: openssl req -text -in CSR.csr -noout
• View SSL certificate info: openssl x509 -text -in certificate.crt -noout

openssl x509 -in hydssl.cer -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
40:01:6e:fb:0a:20:5c:fa:eb:e1:8f:71:d7:3a:bb:78
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA
Validity
Not Before: Dec 12 16:56:15 2019 GMT
Not After : Dec 12 16:56:15 2029 GMT
Subject: C=US, O=IdenTrust, OU=HydrantID Trusted Certificate Service, CN=HydrantID Server CA O1
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ea:1b:99:6c:35:56:30:68:fb:5d:b1:59:41:69:

Check who has issued the SSL certificate:

$ echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509 -noout -issuer
issuer= /C=US/O=Let’s Encrypt/CN=R3

Check whom the SSL certificate is issued to:

$ echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509 -noout -subject
subject= /CN=www.howtouselinux.com

Check for what dates the SSL certificate is valid:

$ echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509 -noout -dates
notBefore=Aug 8 04:49:59 2021 GMT
notAfter=Nov 6 04:49:57 2021 GMT

Show the all above information about the SSL certificate

$ echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509 -noout -issuer -subject -dates
echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509 -noout -issuer -subject -dates
issuer= /C=US/O=Let’s Encrypt/CN=R3
subject= /CN=www.howtouselinux.com
notBefore=Aug 8 04:49:59 2021 GMT
notAfter=Nov 6 04:49:57 2021 GMT

Show the SHA1 fingerprint of the SSL certificate:

$ echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509 -noout -fingerprint
SHA1 Fingerprint=52:DA:6A:D5:81:A8:6C:20:6A:16:EE:2E:A2:19:7A:C6:E7:A2:3E:87

Extract all information from the SSL certificate (decoded)

$ echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509 -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
03:86:f4:63:3d:34:50:a8:47:cc:f7:99:10:1f:79:1c:21:c8
Signature Algorithm: sha256WithRSAEncryption
[…]

Show the SSL certificate itself (encoded):

$ echo | openssl s_client -servername www.howtouselinux.com -connect www.howtouselinux.com:443 2>/dev/null | openssl x509
—–BEGIN CERTIFICATE—–
MIIFGDCCBACgAwIBAgISA4b0Yz00UKhHzPeZEB95HCHIMA0GC
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbm
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xNzAzM
[…]

Check SSL Certificate expiration date

• openssl s_client -servername SERVER_NAME -connect SERVER_NAME:PORT| openssl x509 -noout -dates
• echo | openssl s_client -servername SERVER_NAME -connect SERVER_NAME:PORT | openssl x509 -noout -dates
• openssl x509 -enddate -noout -in /path/to/my/my.pem

openssl x509 -dates -noout -in hydssl.cer
notBefore=Dec 12 16:56:15 2019 GMT
notAfter=Dec 12 16:56:15 2029 GMT

Verify the Keys Match

To verify the public and private keys match, extract the public key from each file and generate a hash output for it. All three files should share the same public key and the same hash value.

Use the following commands to generate a hash of each file’s public key:

• openssl pkey -pubout -in privateKey.key | openssl sha256
• openssl req -pubkey -in CSR.csr -noout | openssl sha256
• openssl x509 -pubkey -in certificate.crt -noout | openssl sha256

David is a Cloud & DevOps Enthusiast. He has years of experience as a Linux engineer. He had working experience in AMD, EMC. He likes Linux, Python, bash, and more. He is a technical blogger and a Software Engineer. He enjoys sharing his learning and contributing to open-source.

howtouselinux.com is dedicated to providing comprehensive information on using Linux.

We hope you find our site helpful and informative.

Источник