2

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files:

cert.pem  chain.pem  fullchain.pem  privkey.pem

As I understand, cert.pem is the public key. Now I tried to verify that this public key is indeed being served by

 openssl s_client -connect my.domain.com:443 | openssl x509 -pubkey -noout    

But the output is completely different from the contents which I see in my cert.pem.

Additionally, I also tried Exporting the certificate in Base64 format from Google Chrome for the same domain. Again very different from cert.pem.

So my question is why is the exported certificate(via Chrome) and public key(via OpenSSL) different from my cert.pem? Are all of them different formats of the same key? If yes, how do I obtain one from other using OpenSSL?

  • 2
    What are you seeing as the subject in the certificate retrieved by the openssl s_client command? Is it a FQDN for a different site hosted on the same server as your site? If so, then the problem may be due to the fact that the server is hosting multiple https sites (by way of SNI), and the certificate that the openssl s_client command is retrieving is that of the default site. If that's the case, then you'll have to use the -servername option with openssl s_client to make it use SNI to get the certificate for your site. – mti2935 Jul 4 at 18:30
  • 1
    cert.pem is the (server/leaf) certificate, not the publickey. A cert contains a publickey, but is not the same as the publickey, and does not look the same. However a cert exported from Chrome is a cert and should match. Try looking at the information in each of the different certs. Is the cert seen by s_client the same as seen by Chrome? How about other browsers? How about other systems or devices (like a phone instead of a computer)? Where is the server (in your home, an office, or a cloud)? – dave_thompson_085 Jul 5 at 1:54
  • Thanks @mti2935 and dave_thompson_085 I checked again. The exported certificate matches cert.pem. I might have made a mistake yesterday. – simplfuzz Jul 5 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.