I would like to download a website's SSL certificate but can only see my cooperate firewall SSL certificate.

Question: When all traffic that flows to my computer from the network have the same ssl signature (due to firewall) is there a way to see the actual site signature? Is there a way to view the actual SSL certification before it is modified?

I know I can go through a proxy and download it that way but I don't want to have to do this work around... Is there a way to inspect the site to find it's cert?

  • 1
    Unless the firewall explicitly provides a way to do it (and there is at least one product which makes this possible) there is no way to find out without bypassing the firewall. – Steffen Ullrich Sep 18 '19 at 5:10
  • 2
    If you can reach ssllabs.com/ssltest that will (among other things) fetch the cert chain and display most details to you, though not all, and for many certs you could take the fingerprint of the relevant cert(s) and look on a transparency log like crt.sh which will display everything and let you download a copy – dave_thompson_085 Sep 18 '19 at 6:18


The firewall configuration you are describing does a SSL MITM. The certificate at the source website is processed by the proxying device, then discarded, it doesn't reach your own computer. This means you can't see the certificate that was provided to the proxy. You need to trust that it was the right one and it was validated correctly (in some cases, it would not validate them properly, leading to the final users being less secure).

That's the reason Extended Validation, HSTS, etc. are disabled by that configuration with a local MITM. You can't know which certificate was presented. In fact, note it may not even have been an original certificate (e.g. the page you are shown is an interstitial).

If you need to inspect the site certificate, you will need not to connect through the MITM firewall (getting an exception, connecting through a VPN, etc.).

  • Mostly correct. But the firewall might explicitly provide a way to get to the original certificate as seen by the firewall and there is at least one product which implements such feature. – Steffen Ullrich Sep 18 '19 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.