49

So I've googled quite a bit for this but it appears that my google-fu fails me - apologies if this is a trivial and already answered question, I could not find anything about this

I'm trying to diagnose an SSL certificate hostname mismatch. When I visit the url in question, it redirects me to another page that has the correct SSL certificate. However, some clients are reporting that they are receiving an SSL certificate hostname mismatch error. My only assumption is that the redirecting page has the wrong certificate and some clients are letting it slide because it resolves with a new page that has the correct certificate.

(The how and why of the issue isn't really the question)

The question:

From the outside in (aka, as a client in the world) - how would one view the certificate that was delivered by a page that automatically redirects to another page?

Robert Petz
  • 615

6 Answers6

49

Use openssl s_client piped to openssl x509:

$ openssl s_client -connect foo.example.com:443 < /dev/null | openssl x509 -text

(Add -servername foo.example.com to the s_client command if the server uses SNI.)

The redirection of stdin from /dev/null for the first invocation of openssl will prevent it from hanging waiting for input.

mwfearnley
  • 922
EEAA
  • 110,608
19

In Firefox 57, if you open the Developer Tools and go to the Network tab:

  1. Make sure Persist Logs is checked
  2. Visit the URL of interest
  3. Click on the top row (i.e., the one corresponding to the request to the server you're interested in, which resulted in the redirect response)
  4. Click on the Security tab (half-way down, still within Network)

This will let you view certificate info such as the issuee common name, issuer details, validity period and fingerprints.

This worked for me on a site responding with a 301 redirect to another HTTPS website. (Unfortunately the accepted answer just gave me the certificate for the final destination page.)

mpavey
  • 433
  • 4
  • 6
6

Also, there is a graphical tool for Windows with detailed text trace: SSL Certificate Verifier Tool and tool description: Verifying The SSL Certificates with a tool and here is an example of how it handles redirects:

enter image description here

Crypt32
  • 7,461
1

Try mangling the url, so it fails to redirect. eg: https://www.example.com/>

Depending on the server you may be able to hit a URL that returns an error instead of redirecting. For example if you're visiting an IIS server appendending > to the URL will show an error page, but the cert can then be viewed in the normal way as this prevents the redirect occurring.

Myster
  • 233
1

Attempting this again today, what worked for me on Windows was:

  1. Go to https://www.ssllabs.com/ssltest/ and enter the domain (not URL) you want the certificate for.
  2. Let the SSL report process.
  3. In the output click the Download server certificate button.
  4. Save the output to a *.cer file.
  5. Double-click the file and voila!

Download server certificate button

Michael12345
  • 205
0

As an alternative to the separate programs mentioned in other answers, you can also disable automatic redirection in your browser.

The option to do this varies by browser, here are methods for Firefox and Chrome:

Community
  • 1
jpa
  • 414