0

I would like to download a website's SSL certificate but can only see my cooperate firewall SSL certificate.

Question: When all traffic that flows to my computer from the network have the same ssl signature (due to firewall) is there a way to see the actual site signature? Is there a way to view the actual SSL certification before it is modified?

I know I can go through a proxy and download it that way but I don't want to have to do this work around... Is there a way to inspect the site to find it's cert?

Improve this question
2
  • 1
    Unless the firewall explicitly provides a way to do it (and there is at least one product which makes this possible) there is no way to find out without bypassing the firewall.
    – Steffen Ullrich
    Commented Sep 18, 2019 at 5:10
  • 2
    If you can reach ssllabs.com/ssltest that will (among other things) fetch the cert chain and display most details to you, though not all, and for many certs you could take the fingerprint of the relevant cert(s) and look on a transparency log like crt.sh which will display everything and let you download a copy
    – dave_thompson_085
    Commented Sep 18, 2019 at 6:18

1 Answer 1

Reset to default
2

No.

The firewall configuration you are describing does a SSL MITM. The certificate at the source website is processed by the proxying device, then discarded, it doesn't reach your own computer. This means you can't see the certificate that was provided to the proxy. You need to trust that it was the right one and it was validated correctly (in some cases, it would not validate them properly, leading to the final users being less secure).

That's the reason Extended Validation, HSTS, etc. are disabled by that configuration with a local MITM. You can't know which certificate was presented. In fact, note it may not even have been an original certificate (e.g. the page you are shown is an interstitial).

If you need to inspect the site certificate, you will need not to connect through the MITM firewall (getting an exception, connecting through a VPN, etc.).

Improve this answer
1
  • Mostly correct. But the firewall might explicitly provide a way to get to the original certificate as seen by the firewall and there is at least one product which implements such feature.
    – Steffen Ullrich
    Commented Sep 18, 2019 at 5:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .