ssl - 如何获取用于 SSL 握手的证书？

Question

有没有办法向特定端点发送一些 HTTP 方法并取回端点正在使用的证书？

假设我有端点 https://myendpoint.mydomain.com/mycontext/myservice

我想获取此端点为我尝试使用它提供的证书信息。

Answer 1

这是规范的 openssl s_client 示例:

$ openssl s_client -connect github.com:443 -servername github.com

CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com,
        CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com,
        CN = DigiCert SHA2 Extended Validation Server CA
verify return:1
depth=0 businessCategory = Private Organization,
        jurisdictionC = US, jurisdictionST = Delaware,
        serialNumber = 5157550, street = "88 Colin P Kelly, Jr Street",
        postalCode = 94107, C = US, ST = California, L = San Francisco,
        O = "GitHub, Inc.", CN = github.com
verify return:1
---
Certificate chain
 0 s:/businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/serialNumber=5157550/street=88 Colin P Kelly, Jr Street/postalCode=94107/C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=github.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHeTCCB[...]
-----END CERTIFICATE-------

[...a bunch more stuff...]

现代编程语言有一个 TLS 库，您可以使用它来提取证书信息。如果他们不这样做，他们肯定有一个 OpenSSL 包装器可以让您到达那里。

在 Go 中，您将使用 crypto/tls 包:

// PeerCertificate is of x509.Certificate type
conn.ConnectionState().PeerCertificates[0].Subject.CommonName

这是 Python(使用 M2Crypto):

>>> import ssl
>>> import M2Crypto
>>> cert = ssl.get_server_certificate(('github.com', 443))
>>> x509.get_subject().as_text()>>> x509 = M2Crypto.X509.load_cert_string(cert)
>>> x509.get_subject().as_text()
'businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/
serialNumber=5157550/street=88 Colin P Kelly,
Jr Street/postalCode=94107, C=US, ST=California, L=San Francisco,
O=GitHub, Inc., CN=github.com'

>>> x509.get_issuer().as_text()
'C=US, O=DigiCert Inc, OU=www.digicert.com,
CN=DigiCert SHA2 Extended Validation Server CA'

>>> x509.get_fingerprint()
'B890FABE8BB63625899E1E0049814797'

# raw cert dump
>>> str(cert) 
'-----BEGIN CERTIFICATE-----\n
MIIHeTCCBmGgAwIBAgIQC/20CQrXteZAwwsW[...]\n
-----END CERTIFICATE-----\n'

本质上，视情况而定。要点是 TLS 根本不绑定(bind)到 HTTP(HTTP 是应用层)，TLS 在 OSI 堆栈中较低。 HTTP 在 TLS 握手完成后开始发生，因此您不必执行 HTTPS 调用来获取对等证书，您只需与 TLS 握手。

( Click for image source )