Display received cert with curl?

Question

With a slightly older version of curl, I had a handy batch file:

curl --verbose -k https://%1 2>&1 |grep -E "Connected to|subject|expire"

This would show me the IP connected to, with the subject and expiration date of the actual certificate negotiated, even if that was not the correct certificate for that domain name -- which is sometimes a problem for our hosting (we host literally thousands of domains on our multitenant application, about half with their own certs).

In specific, I would see something like this in the stderr output before grep filtered it:

* Server certificate:
*  subject: CN=academy-fran.chi.v6.pressero.com
*  start date: Feb 22 04:55:00 2017 GMT
*  expire date: May 23 04:55:00 2017 GMT
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.

Today I had to reinstall the OS on my machine, and reinstalled curl. Now at version 7.52.1 (x86_64-w64-mingw32); previous one seems to have been 7.49.1 (i686-pc-cygwin). Curl no longer displays ANY certificate information, regardless of whether -k is used or not, if the TLS connection succeeds or not.

Is there an option that will give it back to me?

Answer 1

For anyone else on OSX or Linux, you can add this to your ~/.zshrc file:

function seecert () {
  nslookup $1
  (openssl s_client -showcerts -servername $1 -connect $1:443 <<< "Q" | openssl x509 -text | grep -iA2 "Validity")
}

Example usage, after you have run a source ~/.zshrc after the above additions:

% seecert www.google.com
Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
Name:   www.google.com
Address: 172.217.10.100

depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com
verify return:1
DONE
        Validity
            Not Before: Nov  3 07:39:18 2020 GMT
            Not After : Jan 26 07:39:18 2021 GMT

Thanks go to @ross-presser and his answer for the inspiration for this function.