Debugging SSL Connections
I've had a little trouble with the SSL certificate for this site and for some sites for which I do technical maintenance. I wrote up a little about that in Intermediate SSL Certificates. Well, I asked my web hosting provider to install the intermediate certificates for another web site that is also using a GoDaddy certificate. They said that they had done it, but I was still getting warnings in Safari, on both my Mac and my iPhone. So I did some Googling, and found some simple Java code that I could modify, and enable debugging while running, to show the SSL handshake during a connection to a web site.
I have uploaded that code as billstclair.com/blog/images/ssltest.zip. The zip file decompresses into the "ssltest" directory, containing the following files:
ssltest | a bash script to run the java program |
ssltest.class | the compiled version of the Java program |
ssltest.java | the source code for the Java program |
ssltest.zip.sh | a bash script to create ssltest.zip |
You're certainly welcome to look at the Java source, and change it to your liking, but to use the program, you just need to cd to the ssltest directory in your shell, and type the following:
./ssltest billstclair.com
Or change "billstclair.com" to your favorite SSL-enabled web site. It prints quite a bit of stuff, but the most interesting to me were the lines beginning with "chain [", which show the certificate and the intermediate certificates, if any.
I didn't include an ssltest.bat file for Windows, because I have no way to test it, but it should be pretty obvious how to convert the bash script into a Windows batch file.
Enjoy!
Previous Posts:
My Friends...
George Carlin RIP
PricedInGold.com
Intermediate SSL Certificates
Ares: A Sneak Peek--Part One
Lindsey Williams' Life Threatened by Tycoon for Speaking Out About the Non-Energy Crisis
Little Brother
Ron Paul's Campaign for Liberty
Ron Paul Drops Presidential Bid
An Open Letter to the Gun Control Crowd
Simpler SSL debugging
I found an easier way to debug SSL connections, at least the certificate chain part, if you have openssl installed on your system, which most Linux systems, and the Macintosh, do.
Debugging SSL Connections recommends using the
openssl s_client
command. They also talk aboutssldump
, but that's not on my system, so I haven't tried it.The following command connects to billstclair.com with SSL, and prints the certificate chain and some other information about the connection. You can then send HTTP commands (e.g. "GET /\n\n"), to fetch a page, or just type Ctrl-D (EOF).
openssl s_client -connect billstclair.com:443 -showcerts
The Java version is much more verbose, though.
Edit comment