Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
I need to get SSL certificate of some mail servers. I know I need to do execute following steps.
- Do a DNS mx query on the domain name (
dig google.com mx).
- Use the information to download SSL certificate (
openssl s_client -showcerts -connect google.com:443).
But I am not sure what information I should pick up from step 1 and how it should be used in step 2.
43.9k1616 gold badges137137 silver badges169169 bronze badges
asked Oct 13, 2014 at 5:45
14111 gold badge11 silver badge33 bronze badges
To get the SSL/TLS Certificate of an SMPT server pick the domain of one MX record from the answer section of your DNS query and feed it to openssl:
$ dig gmail.com mx
;; ANSWER SECTION:
gmail.com. 3599 IN MX 20 alt2.gmail-smtp-in.l.google.com.
gmail.com. 3599 IN MX 5 gmail-smtp-in.l.google.com.
gmail.com. 3599 IN MX 30 alt3.gmail-smtp-in.l.google.com.
gmail.com. 3599 IN MX 10 alt1.gmail-smtp-in.l.google.com.
gmail.com. 3599 IN MX 40 alt4.gmail-smtp-in.l.google.com.
$ openssl s_client -connect gmail-smtp-in.l.google.com:25 -starttls smtp
Note: it's not a safe assumption that the web server (if there is any) running on the same machine as the SMTP server uses the same certificate.
see also https://serverfault.com/questions/131627/how-to-inspect-remote-smtp-servers-tls-certificate#131628
answered Nov 17, 2015 at 10:27
49633 silver badges55 bronze badges
You must log in to answer this question.