Pipe the output from openssl s_client
(which includes the cert in PEM-format) into openssl x509 -noout -text
and it gives a human-readable display of the cert fields, including the signing algo (in two places). You don't need the sed -n /BEGIN/,/END/p
step; most OpenSSL operations on PEM-format data, including this one, ignore "extra" data outside the PEM block. (This is NOT true for many other programs though.) -showcerts
is useless in this case, since only the first cert, which is the server cert, is displayed.
To be exact, this is the signing algo used on the server's cert by the CA who issued the cert. It isn't performed or even directly controlled by the server.
If you want to look at the whole chain not just the server cert, you do need -showcerts
and you need to run openssl x509 ...
separately on each cert; a simple but somewhat crude way is
echo | openssl s_client ... | \
awk 'BEGIN{p="openssl x509 -noout -text"} {print |p} /-----END/{close(p)}'
echo "" | openssl s_client -connect server:port -prexit 2>/dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p'