Rafael Pfister

TLS / OpenSSL

Comprobar certificados, caducidad, cadena y protocolos.

Mostrar certificado

Obtiene el certificado del servidor y muestra el sujeto, el emisor y el periodo de validez.

HTTPS (443)

PowerShell (Windows)

SslStream (.NET) Integrado 

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
$cert | Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint
$ssl.Dispose(); $c.Close()

openssl Herramienta adicional 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>$null | openssl x509 -noout -subject -issuer -dates

Shell de Unix (bash)

openssl Integrado 

openssl s_client -connect mail.example.com:443 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

gnutls-cli Herramienta adicional 

gnutls-cli --print-cert mail.example.com:443 </dev/null

Outlook Web App

PowerShell (Windows)

SslStream (.NET) Integrado 

$h = "webmail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
$cert | Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint
$ssl.Dispose(); $c.Close()

openssl Herramienta adicional 

"" | openssl s_client -connect webmail.example.com:443 -servername webmail.example.com 2>$null | openssl x509 -noout -subject -issuer -dates

Shell de Unix (bash)

openssl Integrado 

openssl s_client -connect webmail.example.com:443 -servername webmail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

gnutls-cli Herramienta adicional 

gnutls-cli --print-cert webmail.example.com:443 </dev/null

El callback { $true } acepta a propósito también certificados caducados o autofirmados, para que sigan siendo visibles.

Fecha de caducidad

Muestra la fecha de caducidad y si el certificado seguirá siendo válido dentro de 30 días.

HTTPS (443)

PowerShell (Windows)

SslStream (.NET) Integrado 

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
"NotAfter {0}  ({1} days left)" -f $cert.NotAfter, ($cert.NotAfter - (Get-Date)).Days
$ssl.Dispose(); $c.Close()

openssl Herramienta adicional 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>$null | openssl x509 -noout -enddate

Shell de Unix (bash)

openssl Integrado 

echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>/dev/null | openssl x509 -noout -enddate
echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>/dev/null | openssl x509 -noout -checkend 2592000 && echo "valid >30d" || echo "expires <30d"

curl Herramienta adicional 

curl -sSv "https://mail.example.com:443" 2>&1 | grep -E "expire|subject:|issuer:"

Cadena de certificados

Muestra la cadena que entrega el servidor, para detectar certificados intermedios que faltan.

PowerShell (Windows)

X509Chain (.NET) Integrado 

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
$chain = New-Object Security.Cryptography.X509Certificates.X509Chain
$chain.ChainPolicy.RevocationMode = "NoCheck"
[void]$chain.Build($cert)
$chain.ChainElements | ForEach-Object { $_.Certificate.Subject }
$ssl.Dispose(); $c.Close()

openssl Herramienta adicional 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com -showcerts 2>$null

Shell de Unix (bash)

openssl Integrado 

openssl s_client -connect mail.example.com:443 -servername mail.example.com -showcerts </dev/null 2>/dev/null | grep -E "^ *(s:|i:)"

gnutls-cli Herramienta adicional 

gnutls-cli --print-cert mail.example.com:443 </dev/null 2>/dev/null | grep -E "Subject:|Issuer:"

Versiones de TLS

Comprueba qué versiones de TLS acepta el servidor.

HTTPS (443)

PowerShell (Windows)

SslStream (.NET) Integrado 

foreach ($proto in "Tls12", "Tls13") {
  try {
    $c = New-Object Net.Sockets.TcpClient("mail.example.com", 443)
    $ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
    $ssl.AuthenticateAsClient("mail.example.com", $null, [Security.Authentication.SslProtocols]$proto, $false)
    "$proto ok: $($ssl.SslProtocol) / $($ssl.CipherAlgorithm)"
    $ssl.Dispose(); $c.Close()
  } catch { "$proto not supported" }
}

openssl Herramienta adicional 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com -tls1_2 2>$null | Select-String "Protocol"

Shell de Unix (bash)

openssl Integrado 

for proto in -tls1 -tls1_1 -tls1_2 -tls1_3; do
  echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com $proto >/dev/null 2>&1 \
    && echo "$proto supported" || echo "$proto not"
done

nmap Herramienta adicional 

nmap --script ssl-enum-ciphers -p 443 mail.example.com

.NET prueba aquí TLS 1.2 y 1.3; las versiones anteriores suelen estar desactivadas en el framework. openssl también comprueba TLS 1.0/1.1.

Certificado SMTP (STARTTLS)

Muestra el certificado que presenta un servidor de correo durante STARTTLS en el puerto 25.

SMTP (25)

PowerShell (Windows)

SslStream (.NET) Integrado 

$h = "mail.example.com"; $p = 25
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
$r.ReadLine() | Out-Null
$w.WriteLine("EHLO test.example.com"); Start-Sleep -Milliseconds 200; while ($c.Available) { $r.ReadLine() | Out-Null }
$w.WriteLine("STARTTLS"); $r.ReadLine()
$ssl = New-Object Net.Security.SslStream($s, $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotBefore, NotAfter
$ssl.Dispose(); $c.Close()

openssl Herramienta adicional 

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com

Shell de Unix (bash)

openssl Integrado 

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

swaks Herramienta adicional 

swaks --server mail.example.com:25 -tls --quit-after TLS

Examinar un archivo de certificado

Lee un archivo de certificado local (PEM/CER) y muestra el sujeto, el emisor y los SAN.

PowerShell (Windows)

X509Certificate2 (.NET) Integrado 

$cert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 "cert.pem"
$cert | Format-List Subject, Issuer, NotBefore, NotAfter, DnsNameList, Thumbprint

openssl Herramienta adicional 

openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

Shell de Unix (bash)

openssl Integrado 

openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

certtool Herramienta adicional 

certtool --certificate-info --infile cert.pem

Para archivos PFX protegidos con contraseña en PowerShell, use Get-PfxCertificate.

Otras áreas