View a TLS certificate signature

ychaouche · 09-20-2020, 11:51 AM

Dear LQ,

I can't seem to find a proper way to display a certificate's signature. In the browser (firefox), I can only see the signature's algorithm. With openssl commands (x509, verify, s_client) I can't seem to find the right set of command line options. Anybody knows how I can show a certificate's signature using these tools or any other proper tool ?

bathory · 09-21-2020, 12:38 AM

Quote:

Originally Posted by ychaouche

Dear LQ,

I can't seem to find a proper way to display a certificate's signature. In the browser (firefox), I can only see the signature's algorithm. With openssl commands (x509, verify, s_client) I can't seem to find the right set of command line options. Anybody knows how I can show a certificate's signature using these tools or any other proper tool ?

You can use:

Code:

openssl x509 -text -in /path/to/cert.pem

For a remote server:

Code:

echo "" | openssl s_client -connect server:443 2>/dev/null | openssl x509 -text

allend · 09-21-2020, 03:21 AM

In Firefox, if you click on the padlock icon in the address bar, you can drill down to certificate information.

ychaouche · 09-21-2020, 04:26 AM

Thank you all. Apparently the signature is this part at the end of the x509 command output

Quote:

Signature Algorithm: sha256WithRSAEncryption
49:b9:20:e7:62:37:dc:1d:9e:75:70:78:f0:a4:65:70:7f:a2:
8a:07:03:d7:3d:6b:36:96:bf:b8:e4:82:83:60:50:d6:b6:47:
3d:08:ce:b9:37:c8:5a:13:16:a4:f9:49:3f:9e:94:51:ff:49:
5c:d2:6c:59:22:c3:13:97:f6:9c:49:84:9c:13:66:83:36:50:
c8:e3:bd:1c:17:cf:f6:0c:4d:5a:ce:ba:c5:96:ed:9e:8c:37:
fc:0d:90:85:b0:74:c4:7f:a6:81:d1:76:a9:33:38:ea:cb:05:
bb:60:c8:88:ef:05:63:19:73:b0:87:15:2d:35:5e:c0:df:17:
b9:96:0b:a6:da:bf:d8:90:7c:b1:d3:c6:93:e0:3a:28:c1:e5:
01:27:53:fe:37:c6:12:39:ad:1f:e5:fe:35:a8:d6:4f:84:f7:
c8:48:5f:c8:f2:1b:92:71:7c:80:2a:1c:f1:31:11:89:5e:b7:
f6:c1:6c:b1:d0:b2:77:17:e5:18:86:70:c9:60:32:02:c5:e5:
cf:ce:77:92:7a:a6:dd:ed:de:a2:02:11:87:2a:38:05:ef:e2:
70:6e:6f:af:5f:15:75:36:53:f4:4a:e1:73:7d:03:22:be:05:
a9:2e:56:64:56:fc:03:79:84:9d:44:83:db:6d:b9:da:b4:ca:
a3:09:5c:41

allend · 09-21-2020, 11:11 AM

Ahh - Now I see the problem.
Using Firefox you can get the .pem file, but you need the suggestion from @bathory to get the signature..