by Security Certificates
Most modern websites are protected by some form of Security Certificate that ensures the data transmitted from your computer to it (and vice versa) is encrypted. You can usually tell if you are interacting with an encrypted website via the presence of a padlock symbol (usually green in colour) near the website address in your browser.
These certificates are more commonly known as SSL Certificates but in actual fact, the more technically correct name for them is TLS Certificates (it’s just that nobody really calls them that as the older name has quite a sticky sound/feel to it).
Certificate Monitoring
In any case, one of the things we do a lot of at Red Hat Mobile is monitoring, and over the years we’ve designed a large collection of security certificate monitoring checks. The majority of these are powered by the OpenSSL command-line utility (on a Linux system), which contains some pretty neat features.
This article explains some of my favourite things you can do with this utility, targeting a website secured with an SSL Certificate.
Certificate Analysis
Certificate Dumps
Quite often, in order to extract interesting data from a security certificate you first need to dump it’s contents to a file (for subsequent analysis):
$ echo "" | openssl s_client -connect <server-address>:<port> > /tmp/cert.txt
You will, of course, need to replace <server-address> and <port> with the details of the particular website you are targeting.
Determine Expiry Date
Using the dump of your certificate from above, you can then extract it’s expiry date like this:
$ openssl x509 -in /tmp/cert.txt -noout -enddate|cut -d"=" -f2
Determine Common Name (Subject)
The Common Name (sometimes called Subject) for a security certificate is the website address by which the secured website is normally accessed. The reason it is important is that, in order for your website to operate securely (and seamlessly to the user), the Common Name in the certificate must match the server’s Internet address.
$ openssl x509 -in /tmp/cert.txt -noout -subject | sed -n '/^subject/s/^.*CN=//p' | cut -d"." -f2-
Extract Cipher List
This is a slightly more technical task but useful in some circumstances nevertheless (e.g. when determining the level or encryption being used).
$ echo "" | openssl s_client -connect <server-address>:<port> -cipher
View Certificate Chain
In order that certain security certificates can be verified more thoroughly, a trust relationship between them and the Certificate Authority (CA) that created them must be established. Most desktop web browsers are able to do this automatically (as they are pre-programmed with a list of authorities they will always trust) but some mobile devices need some assistance with establishing this trust relationship.
To assist such devices with this, the website administrator can opt to install an additional set of certificates on the server (sometimes known as Intermediate Certs) which will provide a link (or chain) from the server to the CA. This chain can be verified as follows:
$ echo "" | openssl s_client -connect <server-address>:<port> -showcerts -status -verify 0 2>&1 | egrep "Verify return|subject=/serial"
The existence of the string “0 (ok)” in the response indicates a valid certificate chain.
OpenSSL
You can find out more about the openssl command-line utility at http://manpages.ubuntu.com/manpages/xenial/en/man1/openssl.1ssl.html.
