Say that I want to check an https certificate. Suppose I know its SHA-256 fingerprint, how do I compare it to this service search tool, which apparently only gives me the serial number?

edit1: can https://crt.sh be considered at least as trusted as the service I linked above to perform such a check?

  • If you only have the fingerprint you cannot do it. – Steffen Ullrich Sep 28 '17 at 19:23
  • @SteffenUllrich if not that service, is there a similar public one where i can check fingerprint? – jj_p Sep 28 '17 at 19:44
  • Why do you have only the fingerprint and not a domain name? – Steffen Ullrich Sep 28 '17 at 19:48
  • @SteffenUllrich I have the domain name (and therefore the serial as well) but in checking the certificate (say to verify that it has not been tampered with) i thought the only safe way was to look at the fingerprint, isn't this the case? – jj_p Sep 28 '17 at 19:55
  • 1
    it is a good idea to check the fingerprint but this does not mean that the fingerprint need to be used as the way to find the certificate. For example at cryptoreport.websecurity.symantec.com/checker/views/… you can search by name or serial number and then also get the full certificate, which you can then use to compute the fingerprint. – Steffen Ullrich Sep 28 '17 at 20:08

You can get all of the same info from the following command.

$ echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -text
    Version: 3 (0x2)
    Serial Number:
    Signature Algorithm: sha256WithRSAEncryption
    Issuer: C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 EV SSL CA - G3
        Not Before: Jan 15 00:00:00 2016 GMT
        Not After : Jan 15 23:59:59 2018 GMT
    Subject: Organization/serialNumber=413208, C=US/postalCode=22102, ST=Virginia, L=Mclean/street=1800 TYSONS BLVD STE 50, O=HSBC BANK USA, NATIONAL ASSOCIATION, OU=NL-01-02, CN=www.security.us.hsbc.com
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
        RSA Public Key: (2048 bit)
            Modulus (2048 bit):
            Exponent: 65537 (0x10001)
    X509v3 extensions:
        X509v3 Subject Alternative Name: 
            DNS:security.us.hsbc.com, DNS:www.security.us.hsbc.com, DNS:www1.security.us.hsbc.com, DNS:www2.security.us.hsbc.com
        X509v3 Basic Constraints: 
        X509v3 Key Usage: critical
            Digital Signature, Key Encipherment
        X509v3 Extended Key Usage: 
            TLS Web Server Authentication, TLS Web Client Authentication
        X509v3 Certificate Policies: 
            Policy: 2.16.840.1.113733.
              CPS: https://d.symcb.com/cps
              User Notice:
                Explicit Text: https://d.symcb.com/rpa

        X509v3 Authority Key Identifier: 

        X509v3 CRL Distribution Points: 

        Authority Information Access: 
            OCSP - URI:http://sr.symcd.com
            CA Issuers - URI:http://sr.symcb.com/sr.crt

Notice this holds the same info as the crt.sh

enter image description here

  • Thanks, but I think serial is not good for checking a certificate; what i meant is a service that allows me to check the fingerprint i get from my browser or your other script, such as crt.sh that differently form google certification transparency also provides the sha-256 that i can check against: is it to be trusted? (say i would not trust a similar service from symantec) – jj_p Sep 28 '17 at 20:53
  • You want a program to check what you get from your browser or the script I wrote against what? – MikeSchem Sep 28 '17 at 21:00
  • Not necessarily a program, the question is 'against what?'. for example, is crt.sh reliable enough? – jj_p Sep 28 '17 at 21:05
  • 1
    Ah, I see you can use echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -text to get all the information that crt.sh provides. I've never heard of the website crt.sh so I can't comment on whether or not it is trustable, but I have no reason to believe it is not. – MikeSchem Sep 28 '17 at 21:08
  • 1
    With web sites requiring SNI (which are many) you need to add the -servername <hostname> option to s_client in order to get the correct certificate. – Steffen Ullrich Sep 28 '17 at 23:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.