Relating to ‘SSL certificate problem: unable to get local issuer certificate’ error. It is important to note that this applies to the system sending the CURL request, and NOT the server receiving the request. Download the latest cacert.pem from https://curl.se/ca/cacert.pem Add the ‘–cacert /path/to/cacert.pem’ option to the curl command to tell curl where the local … Read more
Update: As of December 2020 and beyond, brew switch does not work, so use the other answer by @angabriel: brew install rbenv/tap/openssl@1.0 ln -sfn /usr/local/Cellar/openssl@1.0/1.0.2t /usr/local/opt/openssl Original Answer: Switch to an older openssl package brew switch openssl 1.0.2s Or, depending on your exact system configuration, you may need to switch to a different version. Check … Read more
With SNI If the remote server is using SNI (that is, sharing multiple SSL hosts on a single IP address) you will need to send the correct hostname in order to get the right certificate. openssl s_client -showcerts -servername www.example.com -connect www.example.com:443 </dev/null Without SNI If the remote server is not using SNI, then you … Read more
With openssl: openssl x509 -enddate -noout -in file.pem The output is on the form: notAfter=Nov 3 22:23:50 2014 GMT Also see MikeW’s answer for how to easily check whether the certificate has expired or not, or whether it will within a certain time period, without having to parse the date above.
openssl genrsa -out mykey.pem 1024 will actually produce a public – private key pair. The pair is stored in the generated mykey.pem file. openssl rsa -in mykey.pem -pubout > mykey.pub will extract the public key and print that out. Here is a link to a page that describes this better. EDIT: Check the examples section … Read more
Your keys may already be in PEM format, but just named with .crt or .key. If the file’s content begins with —–BEGIN and you can read it in a text editor: The file uses base64, which is readable in ASCII, not binary format. The certificate is already in PEM format. Just change the extension to … Read more
You can do that in one command: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 You can also add -nodes (short for “no DES”) if you don’t want to protect your private key with a passphrase. Otherwise it will prompt you for “at least a 4 character” password. The days parameter … Read more