Let's connect to a SSL server with OpenSSL: % openssl s_client -connect webmail.mit.edu:443 CONNECTED(00000003) depth=0 /C=US/ST=Massachusetts/O=Massachusetts Institute of Technology/OU=Information Services and Technology/CN=webmail.mit.edu verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=US/ST=Massachusetts/O=Massachusetts Institute of Technology/OU=Information Services and Technology/CN=webmail.mit.edu verify error:num=27:certificate not trusted verify return:1 depth=0 /C=US/ST=Massachusetts/O=Massachusetts Institute of Technology/OU=Information Services and Technology/CN=webmail.mit.edu verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/C=US/ST=Massachusetts/O=Massachusetts Institute of Technology/OU=Information Services and Technology/CN=webmail.mit.edu i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority --- Server certificate -----BEGIN CERTIFICATE----- MIIDJjCCAo+gAwIBAgIDBNgQMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDQwMzIyMDUwMzI5WhcNMDYwMzIzMDUwMzI5 WjCBnTELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNV BAoTJU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNV BAsTI0luZm9ybWF0aW9uIFNlcnZpY2VzIGFuZCBUZWNobm9sb2d5MRgwFgYDVQQD Ew93ZWJtYWlsLm1pdC5lZHUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKWh aPAWT1gs+bJ5SHBBQqlw+bYezu1WuQrYCfvWS2uxZ1E13ILGgtU2cx8IScJ4IMgA Et8CY/FVJPHRLRiqYAdElVLjfhj0gVn/SKH16GjfytDVP77+UC9ExIP5q7z/G7SC X0gmRDi2LdLrDEhZ6SUAp/BgyBMp89yPGKZ/IQyxAgMBAAGjgcEwgb4wEQYJYIZI AYb4QgEBBAQDAgZAMA4GA1UdDwEB/wQEAwIE8DAdBgNVHQ4EFgQULGH4pmZTnmm3 /SrexOPWGHKmOWQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVz dC5jb20vY3Jscy9zZWN1cmVjYS5jcmwwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj IBBPM5iQn9QwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3 DQEBBQUAA4GBACsnaItaF3GJtfa31TgBfsPJMpAORQKk8JWnAMS36bclti3MGqeu KZM8DvK4BK2q/C6H2aNM+vcOgTbeRPSNebDwfXSXgMNUoYYsPI7Fe4NFRkhSuPYT 8Ez5sxjgtOTUABm+x0VJY5LpOyi0893fOfB4UekVYCey/O0trfPB2zRN -----END CERTIFICATE----- subject=/C=US/ST=Massachusetts/O=Massachusetts Institute of Technology/OU=Information Services and Technology/CN=webmail.mit.edu issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority --- No client certificate CA names sent --- SSL handshake has read 972 bytes and written 340 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 5400D8B9EBFAC841876E68C42C6BB9513321726B08CBAF63D86B50B7D88903BA Session-ID-ctx: Master-Key: D4DC436C404944661AED0D9322CA7070093AE943180E5F706BC1E055E14E3BD6641656C3AC2E74C90A2DBC72C51A234B Key-Arg : None Start Time: 1129663394 Timeout : 300 (sec) Verify return code: 21 (unable to verify the first certificate) --- QUIT DONE % Now, let's put the certificate into a file... % cat > file.txt -----BEGIN CERTIFICATE----- MIIDJjCCAo+gAwIBAgIDBNgQMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDQwMzIyMDUwMzI5WhcNMDYwMzIzMDUwMzI5 WjCBnTELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNV BAoTJU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNV BAsTI0luZm9ybWF0aW9uIFNlcnZpY2VzIGFuZCBUZWNobm9sb2d5MRgwFgYDVQQD Ew93ZWJtYWlsLm1pdC5lZHUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKWh aPAWT1gs+bJ5SHBBQqlw+bYezu1WuQrYCfvWS2uxZ1E13ILGgtU2cx8IScJ4IMgA Et8CY/FVJPHRLRiqYAdElVLjfhj0gVn/SKH16GjfytDVP77+UC9ExIP5q7z/G7SC X0gmRDi2LdLrDEhZ6SUAp/BgyBMp89yPGKZ/IQyxAgMBAAGjgcEwgb4wEQYJYIZI AYb4QgEBBAQDAgZAMA4GA1UdDwEB/wQEAwIE8DAdBgNVHQ4EFgQULGH4pmZTnmm3 /SrexOPWGHKmOWQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVz dC5jb20vY3Jscy9zZWN1cmVjYS5jcmwwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj IBBPM5iQn9QwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3 DQEBBQUAA4GBACsnaItaF3GJtfa31TgBfsPJMpAORQKk8JWnAMS36bclti3MGqeu KZM8DvK4BK2q/C6H2aNM+vcOgTbeRPSNebDwfXSXgMNUoYYsPI7Fe4NFRkhSuPYT 8Ez5sxjgtOTUABm+x0VJY5LpOyi0893fOfB4UekVYCey/O0trfPB2zRN -----END CERTIFICATE----- [simsong@dolphin ~/e170] % Now, let's use OpenSSL's -text option to decode the certificate: % openssl x509 -in file.txt -text Certificate: Data: Version: 3 (0x2) Serial Number: 317456 (0x4d810) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority Validity Not Before: Mar 22 05:03:29 2004 GMT Not After : Mar 23 05:03:29 2006 GMT Subject: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=Information Services and Technology, CN=webmail.mit.edu Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:a5:a1:68:f0:16:4f:58:2c:f9:b2:79:48:70:41: 42:a9:70:f9:b6:1e:ce:ed:56:b9:0a:d8:09:fb:d6: 4b:6b:b1:67:51:35:dc:82:c6:82:d5:36:73:1f:08: 49:c2:78:20:c8:00:12:df:02:63:f1:55:24:f1:d1: 2d:18:aa:60:07:44:95:52:e3:7e:18:f4:81:59:ff: 48:a1:f5:e8:68:df:ca:d0:d5:3f:be:fe:50:2f:44: c4:83:f9:ab:bc:ff:1b:b4:82:5f:48:26:44:38:b6: 2d:d2:eb:0c:48:59:e9:25:00:a7:f0:60:c8:13:29: f3:dc:8f:18:a6:7f:21:0c:b1 Exponent: 65537 (0x10001) X509v3 extensions: Netscape Cert Type: SSL Server X509v3 Key Usage: critical Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment X509v3 Subject Key Identifier: 2C:61:F8:A6:66:53:9E:69:B7:FD:2A:DE:C4:E3:D6:18:72:A6:39:64 X509v3 CRL Distribution Points: URI:http://crl.geotrust.com/crls/secureca.crl X509v3 Authority Key Identifier: keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4 X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication Signature Algorithm: sha1WithRSAEncryption 2b:27:68:8b:5a:17:71:89:b5:f6:b7:d5:38:01:7e:c3:c9:32: 90:0e:45:02:a4:f0:95:a7:00:c4:b7:e9:b7:25:b6:2d:cc:1a: a7:ae:29:93:3c:0e:f2:b8:04:ad:aa:fc:2e:87:d9:a3:4c:fa: f7:0e:81:36:de:44:f4:8d:79:b0:f0:7d:74:97:80:c3:54:a1: 86:2c:3c:8e:c5:7b:83:45:46:48:52:b8:f6:13:f0:4c:f9:b3: 18:e0:b4:e4:d4:00:19:be:c7:45:49:63:92:e9:3b:28:b4:f3: dd:df:39:f0:78:51:e9:15:60:27:b2:fc:ed:2d:ad:f3:c1:db: 34:4d -----BEGIN CERTIFICATE----- MIIDJjCCAo+gAwIBAgIDBNgQMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDQwMzIyMDUwMzI5WhcNMDYwMzIzMDUwMzI5 WjCBnTELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNV BAoTJU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNV BAsTI0luZm9ybWF0aW9uIFNlcnZpY2VzIGFuZCBUZWNobm9sb2d5MRgwFgYDVQQD Ew93ZWJtYWlsLm1pdC5lZHUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKWh aPAWT1gs+bJ5SHBBQqlw+bYezu1WuQrYCfvWS2uxZ1E13ILGgtU2cx8IScJ4IMgA Et8CY/FVJPHRLRiqYAdElVLjfhj0gVn/SKH16GjfytDVP77+UC9ExIP5q7z/G7SC X0gmRDi2LdLrDEhZ6SUAp/BgyBMp89yPGKZ/IQyxAgMBAAGjgcEwgb4wEQYJYIZI AYb4QgEBBAQDAgZAMA4GA1UdDwEB/wQEAwIE8DAdBgNVHQ4EFgQULGH4pmZTnmm3 /SrexOPWGHKmOWQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVz dC5jb20vY3Jscy9zZWN1cmVjYS5jcmwwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj IBBPM5iQn9QwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3 DQEBBQUAA4GBACsnaItaF3GJtfa31TgBfsPJMpAORQKk8JWnAMS36bclti3MGqeu KZM8DvK4BK2q/C6H2aNM+vcOgTbeRPSNebDwfXSXgMNUoYYsPI7Fe4NFRkhSuPYT 8Ez5sxjgtOTUABm+x0VJY5LpOyi0893fOfB4UekVYCey/O0trfPB2zRN -----END CERTIFICATE----- [simsong@dolphin ~/e170] %