3

How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256?

I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate properties, I get:

  • Internet Explorer:

    Signature Algorithm: sha1RSA
    Signature Hash Algorithm: sha1

  • Firefox:

    Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
    Under Fingerprints, I see both SHA256 and SHA-1

OpenSSL command line attempt not working

I tried using OpenSSL command, but for some reasons it errors out for me and if I try to write to a file, the output file is created, but it is blank.

openssl.exe s_client -connect mysite:443 > CertInfo.txt && openssl x509 -text -in CertInfo.txt |
find "Signature Algorithm"

Basically, I need to validate that the certificates are really SHA-1 and I need to upgrade that to a SHA256 or SHA-2.

6

Here's the command for Linux and Windows.

And don't be alarmed about the doubled output line (Signature Algorithm:...). That is expected (and mandatory).

Linux: SHA1 demo site

$ echo '' | openssl s_client -connect sha1.badssl.com:443 -servername sha1.badssl.com 2>/dev/null | openssl x509 -noout -text | grep 'Signature Algorithm'
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Linux: SHA256 demo site

$ echo '' | openssl s_client -connect sha256.badssl.com:443 -servername sha256.badssl.com 2>/dev/null | openssl x509 -noout -text | grep 'Signature Algorithm'
    Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption

Windows cmd.exe: SHA1 demo site

c:\>echo " " | openssl.exe s_client -connect sha1.badssl.com:443 -servername sha1.badssl.com 2>nul | openssl.exe x509 -noout -text | findstr /C:"Signature Algorithm"
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Windows cmd.exe: SHA256 demo site

c:\>echo " " | openssl.exe s_client -connect sha256.badssl.com:443 -servername sha256.badssl.com 2>nul | openssl.exe x509 -noout -text | findstr /C:"Signature Algorithm"
    Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption

Fingerprint is not inside certificate

It's a computed value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.