[SOLVED] Display received cert with curl?

Issue

With a slightly older version of curl, I had a handy batch file:

curl --verbose -k https://%1 2>&1 |grep -E "Connected to|subject|expire"

This would show me the IP connected to, with the subject and expiration date of the actual certificate negotiated, even if that was not the correct certificate for that domain name -- which is sometimes a problem for our hosting (we host literally thousands of domains on our multitenant application, about half with their own certs).

In specific, I would see something like this in the stderr output before grep filtered it:

* Server certificate:
*  subject: CN=academy-fran.chi.v6.pressero.com
*  start date: Feb 22 04:55:00 2017 GMT
*  expire date: May 23 04:55:00 2017 GMT
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.

Today I had to reinstall the OS on my machine, and reinstalled curl. Now at version 7.52.1 (x86_64-w64-mingw32); previous one seems to have been 7.49.1 (i686-pc-cygwin). Curl no longer displays ANY certificate information, regardless of whether -k is used or not, if the TLS connection succeeds or not.

Is there an option that will give it back to me?

Solution

Here is my replacement batch file, using openssl instead of curl:

@echo off
nslookup %1
(openssl s_client -showcerts -servername %1 -connect %1:443 <nul |openssl x509 -text |findstr /I "DNS After") 2>nul

This gives me this output:

C:\>seecert www.google.com
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   www.google.com
Address: 172.217.10.228
Name:   www.google.com
Address: 2607:f8b0:4006:813::2004

            Not After : Aug 16 09:49:00 2018 GMT
                DNS:www.google.com

Answered By - Ross Presser

Answer Checked By - Terry (WPSolving Volunteer)