如何获得SSL握手时使用的证书？

Question

是否有办法将某些HTTP方法发送到特定端点并获取端点正在使用的证书？

假设我有端点https://myendpoint.mydomain.com/mycontext/myservice

我想获取此端点用于尝试使用它的证书信息。

Answer 1

以下是规范的openssl s_client示例：

$ openssl s_client -connect github.com:443 -servername github.com

CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com,
        CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com,
        CN = DigiCert SHA2 Extended Validation Server CA
verify return:1
depth=0 businessCategory = Private Organization,
        jurisdictionC = US, jurisdictionST = Delaware,
        serialNumber = 5157550, street = "88 Colin P Kelly, Jr Street",
        postalCode = 94107, C = US, ST = California, L = San Francisco,
        O = "GitHub, Inc.", CN = github.com
verify return:1
---
Certificate chain
 0 s:/businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/serialNumber=5157550/street=88 Colin P Kelly, Jr Street/postalCode=94107/C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=github.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHeTCCB[...]
-----END CERTIFICATE-------

[...a bunch more stuff...]

现代编程语言中有一个可用于提取证书信息的TLS库。如果他们不这样做，他们肯定有一个OpenSSL包装器可以帮助你。

在Go中，您将使用crypto/tls包：

// PeerCertificate is of x509.Certificate type
conn.ConnectionState().PeerCertificates[0].Subject.CommonName

这是Python（使用M2Crypto）：

>>> import ssl
>>> import M2Crypto
>>> cert = ssl.get_server_certificate(('github.com', 443))
>>> x509.get_subject().as_text()>>> x509 = M2Crypto.X509.load_cert_string(cert)
>>> x509.get_subject().as_text()
'businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/
serialNumber=5157550/street=88 Colin P Kelly,
Jr Street/postalCode=94107, C=US, ST=California, L=San Francisco,
O=GitHub, Inc., CN=github.com'

>>> x509.get_issuer().as_text()
'C=US, O=DigiCert Inc, OU=www.digicert.com,
CN=DigiCert SHA2 Extended Validation Server CA'

>>> x509.get_fingerprint()
'B890FABE8BB63625899E1E0049814797'

# raw cert dump
>>> str(cert) 
'-----BEGIN CERTIFICATE-----\n
MIIHeTCCBmGgAwIBAgIQC/20CQrXteZAwwsW[...]\n
-----END CERTIFICATE-----\n'

在本质上，取决于。外卖是TLS根本不依赖于HTTP（HTTP是应用层），OSI堆栈中的TLS较低。在TLS握手完成后，HTTP开始发生，因此您不必进行HTTPS调用即可获得对等证书，只需握手TLS即可。

（Click for image source）