Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl.
To start with I tried to see the cerificate using following command, but it also does not show up any signning algorithm details.
echo | openssl s_client -showcerts -connect <myhost>:443
Is there a way I can know it using a single command ?
Pipe the output from openssl s_client (which includes the cert in PEM-format) into openssl x509 -noout -text and it gives a human-readable display of the cert fields, including the signing algo (in two places). You don't need the sed -n /BEGIN/,/END/p step; most OpenSSL operations on PEM-format data, including this one, ignore "extra" data outside the PEM block. (This is NOT true for many other programs though.) -showcerts is useless in this case, since only the first cert, which is the server cert, is displayed.
To be exact, this is the signing algo used on the server's cert by the CA who issued the cert. It isn't performed or even directly controlled by the server.
If you want to look at the whole chain not just the server cert, you do need -showcerts and you need to run openssl x509 ... separately on each cert; a simple but somewhat crude way is
echo | openssl s_client ... | \
awk 'BEGIN{p="openssl x509 -noout -text"} {print |p} /-----END/{close(p)}'
echo "" | openssl s_client -connect server:port -prexit 2>/dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p'