Pull SSL Certificates from External Servers

OpenSSL’s s_client is the standard diagnostic tool for inspecting TLS certificates on remote services. It works on HTTPS, SMTPS, and any STARTTLS-enabled protocol.

Basic certificate retrieval

openssl s_client -connect $SERVER:$PORT

This dumps the certificate chain, handshake details, and session parameters to stdout. The server’s certificate appears between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

STARTTLS (mail servers)

For SMTP, IMAP, or POP3 with STARTTLS:

openssl s_client -connect $SERVER:$PORT -starttls smtp

Supported protocols: smtp, pop3, imap, ftp, xmpp, xmpp-server, irc, postgres, mysql, lmtp, nntp, sieve.

Pull the full certificate chain

openssl s_client -connect $SERVER:$PORT -showcerts

-showcerts prints every certificate sent by the server, not just the leaf.

Inspect a saved certificate

# Human-readable text dump
openssl x509 -in $CERT -text -noout
 
# SHA1 fingerprint
openssl x509 -noout -in $CERT -fingerprint
 
# MD5 fingerprint (legacy)
openssl x509 -noout -in $CERT -fingerprint -md5

Non-interactive use

s_client is interactive by default. To pipe input and close immediately:

printf 'QUIT\r\n' | openssl s_client -connect $SERVER:25 -starttls smtp -brief -ign_eof

Sources

• OpenSSL Manual — openssl-s_client
• OpenSSL Manual — openssl-x509

Related: get-ssl-certificate, legacy-tls-assessment-friction, OpenSSL SECLEVEL