2

I want to save a web request and prove that it was signed by a specific certificate.

What I want is the TLS equivalent of:

-----BEGIN PGP SIGNED MESSAGE-----
<!doctype html>
<head>
....
-----BEGIN PGP SIGNATURE-----
iQCVAwUBMoSCcM4T3nOFCCzVAQFJaAP/eaP2nssHHDTHyPBSjgwyzryguwBd2szF

If I use curl, I can get the certificate details:

curl -v https://www.googleapis.com/books/v1/volumes?q=isbn:0747532699
*   Trying 172.217.23.10...
* TCP_NODELAY set
* Connected to www.googleapis.com (172.217.23.10) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=Mountain View; O=Google LLC; CN=*.googleapis.com
*  start date: Aug 28 18:23:00 2018 GMT
*  expire date: Nov 20 18:23:00 2018 GMT
*  subjectAltName: host "www.googleapis.com" matched cert's "*.googleapis.com"
*  issuer: C=US; O=Google Trust Services; CN=Google Internet Authority G3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7f8f53004400)
> GET /books/v1/volumes?q=isbn:0747532699 HTTP/2
> Host: www.googleapis.com
> User-Agent: curl/7.54.0
> Accept: */*
> 
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200 
< expires: Wed, 12 Sep 2018 13:16:30 GMT
< date: Wed, 12 Sep 2018 13:16:30 GMT
< cache-control: private, max-age=0, must-revalidate, no-transform
< etag: "IUREzboS_XZycecz4xfru1ipYfo/nF7MhC3ZwSUI-e0L9XQwHBYBkrM"
< vary: Origin
< vary: X-Origin
< content-type: application/json; charset=UTF-8
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-xss-protection: 1; mode=block
< content-length: 3336
< server: GSE
< alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
< 

But that doesn't give me the signed response.

marked as duplicate by Steffen Ullrich tls Sep 12 '18 at 13:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    "But that doesn't give me the signed response." - in short: the TLS server does not sign the response. – Steffen Ullrich Sep 12 '18 at 14:24

Browse other questions tagged or ask your own question.