1

I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl.

To start with I tried to see the cerificate using following command, but it also does not show up any signning algorithm details.

echo | openssl s_client -showcerts -connect <myhost>:443

Is there a way I can know it using a single command ?

1

Pipe the output from openssl s_client (which includes the cert in PEM-format) into openssl x509 -noout -text and it gives a human-readable display of the cert fields, including the signing algo (in two places). You don't need the sed -n /BEGIN/,/END/p step; most OpenSSL operations on PEM-format data, including this one, ignore "extra" data outside the PEM block. (This is NOT true for many other programs though.) -showcerts is useless in this case, since only the first cert, which is the server cert, is displayed.

To be exact, this is the signing algo used on the server's cert by the CA who issued the cert. It isn't performed or even directly controlled by the server.

If you want to look at the whole chain not just the server cert, you do need -showcerts and you need to run openssl x509 ... separately on each cert; a simple but somewhat crude way is

echo | openssl s_client ... | \
awk 'BEGIN{p="openssl x509 -noout -text"} {print |p} /-----END/{close(p)}'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.