I am trying to query all the https sites on various server VLANs within my network. I can get a list of servers listening on tcp/443 with nmap, and get even more information about the certs using some of the nmap scripts (e.g.,
ssl-cert.nse). However, some servers are utilizing SNI, so just scanning by IP address only shows the "default" server that answers at a particular address (i.e., no HOST specified in the HTTP header).
openssl s_client has the parameter
-servername that overcomes this limitation. I suppose one solution would be to get a list of hosts listening on tcp/443 from nmap, and pass that information to openssl rather than an nmap ssl script. I haven't looked, but cURL may also have this ability. It would be nice to do the whole thing in nmap if possible though.
For the sake of argument, let's say that I have a list of hostnames. Can anyone think of a "pure-nmap" solution to identifying certification information (e.g., expiration date, hash algorithm, etc)?