Get certificate fingerprint of HTTPS server from command line?

Solution 1:

The page at http://wiki.debuntu.org/wiki/OpenSSL#Retrieving_certificate_informations lists the command lines for that (and printing out the relevant information). From that page and some of the man pages, it seems like what you want is (for bash):

openssl s_client -connect <host>:<port> < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin

If you want the whole certificate, leave off the | symbol and everything after it.

Solution 2:

this is also enough:

openssl x509 -fingerprint -in server.crt

Solution 3:

This is an old thread but there is an easier way I found. Assuming you have the crt file:

$ cat server.crt|openssl x509 -fingerprint 
MD5 Fingerprint=D1:BA:B0:17:66:6D:7F:42:7B:91:1E:22:7E:3A:27:D2

Solution 4:

Background

Since Mercurial 3.9, Mercurial requires the more secure SHA-256 fingerprint, as opposed to SHA-1 from prior versions. Jeremiah's answer explains how to compute the SHA-1 fingerprint. As pointed out in J.Money's comment, one must now add the -sha256 flag to get the correct fingerprint.

The new command:

openssl s_client -connect <host>:<port> < /dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin

where <host>:<port> should be substituted as appropriate. (To answer the original question, one would use wiki.pydlnadms.googlecode.com:443, as noted by yanokwa.) You must omit https:// from the URL, otherwise you will get the error Expecting: TRUSTED CERTIFICATE.

One can then add the resulting SHA-256 fingerprint to Mercurial's global settings file (~/.hgrc).