How can I fetch a certificate from a URL?

Question

I'm trying to find a function similar to Python's ssl.get_server_certificate(), which takes a hostname-port pair and returns a PEM-encoded certificate, but I haven't had any luck.

I've done a fair bit of digging around, but the closest question I've found (Get remote ssl certificate in golang) did not help, nor did reading through the documentation for the package crypto/tls. I'm new to Go, so I may have not understood something in the documentation

score 11 · Accepted Answer · 2017-10-14 10:47:19Z

11

import (
    "bytes"
    "crypto/tls"
    "encoding/pem"
)

func GetCertificatesPEM(address string) (string, error) {
    conn, err := tls.Dial("tcp", address, &tls.Config{
        InsecureSkipVerify: true,
    })
    if err != nil {
        return "", err
    }
    defer conn.Close()
    var b bytes.Buffer
    for _, cert := range conn.ConnectionState().PeerCertificates {
        err := pem.Encode(&b, &pem.Block{
            Type: "CERTIFICATE",
            Bytes: cert.Raw,
        })
        if err != nil {
            return "", err
        }
    }
    return b.String(), nil
}

Usage:

certs, err := GetCertificatesPEM("example.com:443")

edited Oct 14, 2017 at 10:47

answered Oct 13, 2017 at 18:18

user142162

Sign up to request clarification or add additional context in comments.

2 Comments

minghua Over a year ago

Any idea why this is not working for "bitbucket.org:443" or "api.bitbucket.org:443"?

minghua Over a year ago

Sorry it's my problem when printing the result. It works perfectly! Thanks.

Evgenii Fedotov · Accepted Answer · 2021-10-03 17:43:38Z

0

That won’t work if the server checks the client certificate. If the client has no valid certificate, the server breaks TLS connection (the code above does not have a certificate at all.

Server <---Client Hello------------- golang code
Server ----Server Hello with cert--> golang code On this step you already have the server's certificate, but unable to get it in tls.Dial()(connection), because the connection is not established.
Server <---Client cert(empty cert)----golang code.
Server(if validation is enabled) breaks connection because client certificate is not valid.

Eventually, golang code returns with an error and you do not get a server's certificate, no matter that you already have it on step 2.

answered Oct 3, 2021 at 17:43

Evgenii Fedotov

511 silver badge1 bronze badge

2 Comments

Marco Sacchi Over a year ago

Please consider including some source code to make the answer more complete.

Evgenii Fedotov Over a year ago

I wrote about code marked as "solution". That code won’t work if the server checks the client certificate.

Collectives™ on Stack Overflow

How can I fetch a certificate from a URL?

2 Answers 2

2 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related