OpenSSL check if a SSL certificate is SHA-1 or SHA256 signed

Question

How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256?

I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate properties, I get:

• Internet Explorer:

  Signature Algorithm: sha1RSA
  Signature Hash Algorithm: sha1

• Firefox:

  Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
  Under Fingerprints, I see both SHA256 and SHA-1

OpenSSL command line attempt not working

I tried using OpenSSL command, but for some reasons it errors out for me and if I try to write to a file, the output file is created, but it is blank.

openssl.exe s_client -connect mysite:443 > CertInfo.txt && openssl x509 -text -in CertInfo.txt |
find "Signature Algorithm"

Basically, I need to validate that the certificates are really SHA-1 and I need to upgrade that to a SHA256 or SHA-2.

Answer 1

Here's the command for Linux and Windows.

And don't be alarmed about the doubled output line (Signature Algorithm: ...). That is expected (and mandatory).

Linux: SHA1 demo site

$ echo '' | openssl s_client -connect sha1.badssl.com:443 -servername sha1.badssl.com 2>/dev/null | openssl x509 -noout -text | grep 'Signature Algorithm'
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Linux: SHA256 demo site

$ echo '' | openssl s_client -connect sha256.badssl.com:443 -servername sha256.badssl.com 2>/dev/null | openssl x509 -noout -text | grep 'Signature Algorithm'
    Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption

Windows cmd.exe: SHA1 demo site

c:\>echo " " | openssl.exe s_client -connect sha1.badssl.com:443 -servername sha1.badssl.com 2>nul | openssl.exe x509 -noout -text | findstr /C:"Signature Algorithm"
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Windows cmd.exe: SHA256 demo site

c:\>echo " " | openssl.exe s_client -connect sha256.badssl.com:443 -servername sha256.badssl.com 2>nul | openssl.exe x509 -noout -text | findstr /C:"Signature Algorithm"
    Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption

Fingerprint is not inside certificate

It's a computed value.

Answer 2

In addition to looking at Signature Algorithm (as mentioned in the existing answer), you may have to also look for Hash Algorithm.

For example, in case of RSASSA-PSS certificates, the signature algorithm just mentions "rsassaPss" but the hash algorithm indicates whether SHA1 or SHA256 is used.

$ openssl x509 -in sha1.pem -noout -text | grep -e 'Signature Algorithm' -e 'Hash Algorithm'
    Signature Algorithm: rsassaPss
     Hash Algorithm: sha1 (default)
Signature Algorithm: rsassaPss
     Hash Algorithm: sha1 (default)

$ openssl x509 -in sha256.pem -noout -text | grep -e 'Signature Algorithm' -e 'Hash Algorithm'
    Signature Algorithm: rsassaPss
     Hash Algorithm: sha256
Signature Algorithm: rsassaPss
     Hash Algorithm: sha256