2

A client sends data to a server over an SSL-encrypted connection. I want to see the client certificates that are sent to the server.

I got the server certificate with:

openssl s_client -connect 192.168.254.208:40004 </dev/null 2>/dev/null | openssl x509 -outform PEM > cert.pem

But how to get the client cert?

Is this possible with openssl s_server?

or can I use a simple python ssl-socket? (I have access to the certificates and keys from the server.) I only want to know which certificate the client sends.

2 Answers 2

2

is this possible with openssl s_server?

Start a test server which requires a client certificate. The certificate send by the client is shown as PEM in the server output:

openssl s_server -cert ... -verify 2

can I use a simple python ssl-socket

The peer_certificate method can not only be used by the client to get the server certificate but also by the server to get the client certificate.

0

Start a Openssl server on the expected port by the client like this :

openssl s_server -4 -cert my_server.pem -accept 40004 -verify 2 -www -trace
  • -4 is for IP version 4
  • -verify 2 is to ask your client certificate to be verified at depth 2
  • -www if you client is using HTTP as protocol against the server, not mandatory it depends more on your use case.
  • -trace the most important flag, which produces an extended output, including the client certificate in PEM format

This solution is manual, I didn't have any way to do it programmatically.

4
  • Isn't this repeating the accepted answer?
    – schroeder
    May 1 at 19:01
  • A working example which is great as openssl command is quite complex and got a lot of options/flags.
    – Nexus1138
    May 2 at 6:34
  • I think the right way would be to comment on the other answer with the suggestion to edit it... May 2 at 16:29
  • From what I understood of StackExchange rules, to aim is to provide the best answer. That's why I created the answer instead of commenting over the other one, for the sake of clarity. People then decide which is the best one, IMO.
    – Nexus1138
    May 3 at 7:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .