Ver los detalles del certificado TLS de un sitio web en la línea de comando usando GnuTLS

Última actualización el 27 de diciembre de 2023

Con GnuTLS, podemos ver los detalles del certificado de un sitio web con los siguientes comandos (reemplace «example.com» con su sitio web de interés):

gnutls-cli --print-cert example.com < /dev/null | certtool --certificate-info

En el comando anterior, gnutls-cli --print-cert example.com < /dev/null Imprime el certificado del sitio web en formato PEM en la salida estándar. Su salida luego se envía como entrada estándar a certtool --certificate-infopara imprimir información en el certificado dado.

El resultado del comando anterior se parece al siguiente:

X.509 Certificate Information:
	Version: 3
	Serial Number (hex): 0c1fcb184518c7e3866741236d6b73f1
	Issuer: CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US
	Validity:
		Not Before: Fri Jan 13 00:00:00 UTC 2023
		Not After: Tue Feb 13 23:59:59 UTC 2024
	Subject: CN=www.example.org,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US
	Subject Public Key Algorithm: RSA
	Algorithm Security Level: Medium (2048 bits)
		Modulus (bits 2048):
			00:c2:80:77:89:59:b8:45:6f:ba:4a:d9:11:fa:7b:ad
			c7:57:d0:7a:fb:b6:fa:dd:05:bb:a2:81:71:bb:e1:7f
			21:d2:5f:2e:f0:d2:72:4e:75:34:f8:8d:62:e3:4a:da
			51:90:d4:01:3d:9c:0c:c0:71:f7:e6:2f:b6:d6:07:67
			26:d0:de:ff:17:ce:f0:85:fd:31:c1:66:ca:87:65:05
			47:2a:5f:c0:ab:b8:8c:c3:bf:d0:17:7f:63:a3:5c:f0
			46:fb:86:aa:fb:4d:d7:2a:5e:7f:9a:e0:13:97:7d:be
			fb:7d:35:57:0d:5d:5e:81:98:35:ea:16:42:a2:d3:b0
			74:f7:59:2d:ed:38:e7:fe:7a:1b:b3:36:e6:7e:ae:3f
			9e:a6:16:83:de:53:01:4e:81:00:ae:bb:42:f5:1f:75
			29:34:cd:e9:84:80:38:ae:3c:37:14:c0:f0:27:ce:30
			52:b9:8a:dc:5f:22:a0:79:f8:4f:4e:49:04:e2:75:7c
			aa:2f:2a:1e:03:ec:71:4c:a3:2a:61:fc:6f:ca:91:1e
			93:5a:2e:78:08:58:f6:ee:bb:34:20:5d:9a:e6:af:c6
			d7:f2:bf:0a:7b:fa:8e:92:77:e3:6c:7b:0c:40:86:64
			4a:15:ec:70:d7:72:8e:63:30:e1:0b:ef:5a:30:97:2e
			25
		Exponent (bits 24):
			01:00:01
	Extensions:
		Authority Key Identifier (not critical):
			b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
		Subject Key Identifier (not critical):
			b0933fe81782fd6cb2b61787cbe380fe829b019e
		Subject Alternative Name (not critical):
			DNSname: www.example.org
			DNSname: example.net
			DNSname: example.edu
			DNSname: example.com
			DNSname: example.org
			DNSname: www.example.com
			DNSname: www.example.edu
			DNSname: www.example.net
		Key Usage (critical):
			Digital signature.
			Key encipherment.
		Key Purpose (not critical):
			TLS WWW Server.
			TLS WWW Client.
		CRL Distribution points (not critical):
			URI: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl
			URI: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl
		Certificate Policies (not critical):
			2.23.140.1.2.2 (CA/B Organization Validated)
				URI: http://www.digicert.com/CPS
		Authority Information Access (not critical):
			Access Method: 1.3.6.1.5.5.7.48.1 (id-ad-ocsp)
			Access Location URI: http://ocsp.digicert.com
			Access Method: 1.3.6.1.5.5.7.48.2 (id-ad-caIssuers)
			Access Location URI: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt
		Basic Constraints (not critical):
			Certificate Authority (CA): FALSE
		CT Precertificate SCTs (not critical):
			Signed Certificate Timestamp 1:
				Version: 1
				Log ID: eecdd064d5db1acec55cb79db4cd13a23287467cbcecdec351485946711fb59b
				Time: Fri, Jan 13 13:18:21 UTC 2023
				Extensions: none
				Signature algorithm: ECDSA-SHA256
				Signature: 3045022100aadf9f2ba8c574603ab6fd045adf6b6b1d16601578adef6381982ad338b8d90502204061d722a93ef817d41ade134c01526ae2395521252efb2a0175f777d3dbcefb
			Signed Certificate Timestamp 2:
				Version: 1
				Log ID: 73d99e891b4c9678a0207d479de6b2c61cd0515e71192a8c6b80107ac17772b5
				Time: Fri, Jan 13 13:18:22 UTC 2023
				Extensions: none
				Signature algorithm: ECDSA-SHA256
				Signature: 3046022100d7649414ae6b80ba91cef81cafb6735789e5f99b7d965a00cd12df3dceef48f0022100973dbc12731d6b13e06315ac199558cb8ffd4fb0cd0a41072c7c70d92544cbc0
			Signed Certificate Timestamp 3:
				Version: 1
				Log ID: 48b0e36bdaa647340fe56a02fa9d30eb1c5201cb56dd2c81d9bbbfab39d88473
				Time: Fri, Jan 13 13:18:22 UTC 2023
				Extensions: none
				Signature algorithm: ECDSA-SHA256
				Signature: 3045022100de5b847b61a3258c27709007fd626051213205159058470ccfe7944f53842c2102200fbcf257ca9edada4cf0257dcfedfa87e57928deb3e10b34685d877a5be4240a
	Signature Algorithm: RSA-SHA256
	Signature:
		59:e4:4a:d8:a9:82:ba:9a:4a:f1:63:0c:6d:76:26:75
		b3:3c:74:be:c5:f7:3d:a7:91:92:f8:cf:06:2d:58:10
		ed:f3:b8:d6:fc:6c:ff:13:96:32:cd:4f:e9:87:24:85
		0b:74:a2:c2:f6:0f:f5:a7:d8:7d:76:8a:ae:e9:c9:58
		2b:6e:00:6f:b9:cd:24:ee:c4:42:c5:4c:16:85:9d:34
		61:39:23:bf:c6:8e:95:c9:84:a9:b2:e5:41:0f:44:78
		d7:95:b9:cf:d9:74:bf:58:4f:e7:16:ff:7c:40:30:c4
		6c:4e:22:4d:cb:83:67:3a:93:bf:2b:c5:c5:9c:1a:f2
		43:a1:25:3b:84:f6:f7:53:6e:a8:85:ae:de:14:74:91
		30:06:0d:f2:07:d4:c4:08:ba:43:64:c5:e2:3f:da:ac
		c5:41:af:a4:37:e8:42:76:74:f7:13:bb:4a:7d:36:59
		81:9b:c7:44:df:89:73:b9:33:42:e8:60:c2:4d:61:5d
		12:5a:10:f6:ef:ff:33:89:14:50:e8:d6:9f:c6:b9:5c
		2b:35:db:ad:ed:dd:36:b6:25:f2:95:8a:ac:69:3f:9a
		fe:1a:f8:15:28:6d:ea:18:5a:c2:d2:62:18:af:40:78
		b5:fa:5e:09:8f:53:f9:cc:f8:23:a1:83:31:23:f4:c6
Other Information:
	Fingerprint:
		sha1:f2aad73d32683b716d2a7d61b51c6d5764ab3899
		sha256:5ef2f214260ab8f58e55eea42e4ac04b0f171807d8d1185fddd67470e9ab6096
	Public Key ID:
		sha1:9a1e8f70cb8292d4600f87cafc2289b3c1d3e350
		sha256:5ecfa98d1a76dd09265de1f7d4a1008ccd5a5afc691d3eaf632faada5b6ab5a3
	Public Key PIN:
		pin-sha256:Xs+pjRp23QkmXeH31KEAjM1aWvxpHT6vYy+q2ltqtaM=

-----BEGIN CERTIFICATE-----
MIIHSjCCBjKgAwIBAgIQDB/LGEUYx+OGZ0EjbWtz8TANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSkwJwYDVQQDEyBE
aWdpQ2VydCBUTFMgUlNBIFNIQTI1NiAyMDIwIENBMTAeFw0yMzAxMTMwMDAwMDBa
Fw0yNDAyMTMyMzU5NTlaMIGWMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZv
cm5pYTEUMBIGA1UEBxMLTG9zIEFuZ2VsZXMxQjBABgNVBAoMOUludGVybmV0wqBD
b3Jwb3JhdGlvbsKgZm9ywqBBc3NpZ25lZMKgTmFtZXPCoGFuZMKgTnVtYmVyczEY
MBYGA1UEAxMPd3d3LmV4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAwoB3iVm4RW+6StkR+nutx1fQevu2+t0Fu6KBcbvhfyHSXy7w0nJO
dTT4jWLjStpRkNQBPZwMwHH35i+21gdnJtDe/xfO8IX9McFmyodlBUcqX8CruIzD
v9AXf2OjXPBG+4aq+03XKl5/muATl32++301Vw1dXoGYNeoWQqLTsHT3WS3tOOf+
ehuzNuZ+rj+ephaD3lMBToEArrtC9R91KTTN6YSAOK48NxTA8CfOMFK5itxfIqB5
+E9OSQTidXyqLyoeA+xxTKMqYfxvypEek1oueAhY9u67NCBdmuavxtfyvwp7+o6S
d+NsewxAhmRKFexw13KOYzDhC+9aMJcuJQIDAQABo4ID2DCCA9QwHwYDVR0jBBgw
FoAUt2ui6qiqhIx56rTaD5iyxZV2ufQwHQYDVR0OBBYEFLCTP+gXgv1ssrYXh8vj
gP6CmwGeMIGBBgNVHREEejB4gg93d3cuZXhhbXBsZS5vcmeCC2V4YW1wbGUubmV0
ggtleGFtcGxlLmVkdYILZXhhbXBsZS5jb22CC2V4YW1wbGUub3Jngg93d3cuZXhh
bXBsZS5jb22CD3d3dy5leGFtcGxlLmVkdYIPd3d3LmV4YW1wbGUubmV0MA4GA1Ud
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwgY8GA1Ud
HwSBhzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0
VExTUlNBU0hBMjU2MjAyMENBMS00LmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGln
aWNlcnQuY29tL0RpZ2lDZXJ0VExTUlNBU0hBMjU2MjAyMENBMS00LmNybDA+BgNV
HSAENzA1MDMGBmeBDAECAjApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2lj
ZXJ0LmNvbS9DUFMwfwYIKwYBBQUHAQEEczBxMCQGCCsGAQUFBzABhhhodHRwOi8v
b2NzcC5kaWdpY2VydC5jb20wSQYIKwYBBQUHMAKGPWh0dHA6Ly9jYWNlcnRzLmRp
Z2ljZXJ0LmNvbS9EaWdpQ2VydFRMU1JTQVNIQTI1NjIwMjBDQTEtMS5jcnQwCQYD
VR0TBAIwADCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHYA7s3QZNXbGs7FXLed
tM0TojKHRny87N7DUUhZRnEftZsAAAGFq0gFIwAABAMARzBFAiEAqt+fK6jFdGA6
tv0EWt9rax0WYBV4re9jgZgq0zi42QUCIEBh1yKpPvgX1BreE0wBUmriOVUhJS77
KgF193fT2877AHcAc9meiRtMlnigIH1HneayxhzQUV5xGSqMa4AQesF3crUAAAGF
q0gFnwAABAMASDBGAiEA12SUFK5rgLqRzvgcr7ZzV4nl+Zt9lloAzRLfPc7vSPAC
IQCXPbwScx1rE+BjFawZlVjLj/1PsM0KQQcsfHDZJUTLwAB2AEiw42vapkc0D+Vq
AvqdMOscUgHLVt0sgdm7v6s52IRzAAABhatIBV4AAAQDAEcwRQIhAN5bhHthoyWM
J3CQB/1iYFEhMgUVkFhHDM/nlE9ThCwhAiAPvPJXyp7a2kzwJX3P7fqH5Xko3rPh
CzRoXYd6W+QkCjANBgkqhkiG9w0BAQsFAAOCAQEAWeRK2KmCuppK8WMMbXYmdbM8
dL7F9z2nkZL4zwYtWBDt87jW/Gz/E5YyzU/phySFC3SiwvYP9afYfXaKrunJWCtu
AG+5zSTuxELFTBaFnTRhOSO/xo6VyYSpsuVBD0R415W5z9l0v1hP5xb/fEAwxGxO
Ik3Lg2c6k78rxcWcGvJDoSU7hPb3U26oha7eFHSRMAYN8gfUxAi6Q2TF4j/arMVB
r6Q36EJ2dPcTu0p9NlmBm8dE34lzuTNC6GDCTWFdEloQ9u//M4kUUOjWn8a5XCs1
263t3Ta2JfKViqxpP5r+GvgVKG3qGFrC0mIYr0B4tfpeCY9T+cz4I6GDMSP0xg==
-----END CERTIFICATE-----

X.509 Certificate Information:
	Version: 3
	Serial Number (hex): 06d8d904d5584346f68a2fa754227ec4
	Issuer: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
	Validity:
		Not Before: Wed Apr 14 00:00:00 UTC 2021
		Not After: Sun Apr 13 23:59:59 UTC 2031
	Subject: CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US
	Subject Public Key Algorithm: RSA
	Algorithm Security Level: Medium (2048 bits)
		Modulus (bits 2048):
			00:c1:4b:b3:65:47:70:bc:dd:4f:58:db:ec:9c:ed:c3
			66:e5:1f:31:13:54:ad:4a:66:46:1f:2c:0a:ec:64:07
			e5:2e:dc:dc:b9:0a:20:ed:df:e3:c4:d0:9e:9a:a9:7a
			1d:82:88:e5:11:56:db:1e:9f:58:c2:51:e7:2c:34:0d
			2e:d2:92:e1:56:cb:f1:79:5f:b3:bb:87:ca:25:03:7b
			9a:52:41:66:10:60:4f:57:13:49:f0:e8:37:67:83:df
			e7:d3:4b:67:4c:22:51:a6:df:0e:99:10:ed:57:51:74
			26:e2:7d:c7:ca:62:2e:13:1b:7f:23:88:25:53:6f:c1
			34:58:00:8b:84:ff:f8:be:a7:58:49:22:7b:96:ad:a2
			88:9b:15:bc:a0:7c:df:e9:51:a8:d5:b0:ed:37:e2:36
			b4:82:4b:62:b5:49:9a:ec:c7:67:d6:e3:3e:f5:e3:d6
			12:5e:44:f1:bf:71:42:7d:58:84:03:80:b1:81:01:fa
			f9:ca:32:bb:b4:8e:27:87:27:c5:2b:74:d4:a8:d6:97
			de:c3:64:f9:ca:ce:53:a2:56:bc:78:17:8e:49:03:29
			ae:fb:49:4f:a4:15:b9:ce:f2:5c:19:57:6d:6b:79:a7
			2b:a2:27:20:13:b5:d0:3d:40:d3:21:30:07:93:ea:99
			f5
		Exponent (bits 24):
			01:00:01
	Extensions:
		Basic Constraints (critical):
			Certificate Authority (CA): TRUE
			Path Length Constraint: 0
		Subject Key Identifier (not critical):
			b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4
		Authority Key Identifier (not critical):
			03de503556d14cbb66f0a3e21b1bc397b23dd155
		Key Usage (critical):
			Digital signature.
			Certificate signing.
			CRL signing.
		Key Purpose (not critical):
			TLS WWW Server.
			TLS WWW Client.
		Authority Information Access (not critical):
			Access Method: 1.3.6.1.5.5.7.48.1 (id-ad-ocsp)
			Access Location URI: http://ocsp.digicert.com
			Access Method: 1.3.6.1.5.5.7.48.2 (id-ad-caIssuers)
			Access Location URI: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt
		CRL Distribution points (not critical):
			URI: http://crl3.digicert.com/DigiCertGlobalRootCA.crl
		Certificate Policies (not critical):
			2.16.840.1.114412.2.1
			2.23.140.1.1 (CA/B Extended Validation)
			2.23.140.1.2.1 (CA/B Domain Validated)
			2.23.140.1.2.2 (CA/B Organization Validated)
			2.23.140.1.2.3 (CA/B Individual Validated)
	Signature Algorithm: RSA-SHA256
	Signature:
		80:32:ce:5e:0b:dd:6e:5a:0d:0a:af:e1:d6:84:cb:c0
		8e:fa:85:70:ed:da:5d:b3:0c:f7:2b:75:40:fe:85:0a
		fa:f3:31:78:b7:70:4b:1a:89:58:ba:80:bd:f3:6b:1d
		e9:7e:cf:0b:ba:58:9c:59:d4:90:d3:fd:6c:fd:d0:98
		6d:b7:71:82:5b:cf:6d:0b:5a:09:d0:7b:de:c4:43:d8
		2a:a4:de:9e:41:26:5f:bb:8f:99:cb:dd:ae:e1:a8:6f
		9f:87:fe:74:b7:1f:1b:20:ab:b1:4f:c6:f5:67:5d:5d
		9b:3c:e9:ff:69:f7:61:6c:d6:d9:f3:fd:36:c6:ab:03
		88:76:d2:4b:2e:75:86:e3:fc:d8:55:7d:26:c2:11:77
		df:3e:02:b6:7c:f3:ab:7b:7a:86:36:6f:b8:f7:d8:93
		71:cf:86:df:73:30:fa:7b:ab:ed:2a:59:c8:42:84:3b
		11:17:1a:52:f3:c9:0e:14:7d:a2:5b:72:67:ba:71:ed
		57:47:66:c5:b8:02:4a:65:34:5e:8b:d0:2a:3c:20:9c
		51:99:4c:e7:52:9e:f7:6b:11:2b:0d:92:7e:1d:e8:8a
		eb:36:16:43:87:ea:2a:63:bf:75:3f:eb:de:c4:03:bb
		0a:3c:f7:30:ef:eb:af:4c:fc:8b:36:10:73:3e:f3:a4
Other Information:
	Fingerprint:
		sha1:1c58a3a8518e8759bf075b76b750d4f2df264fcd
		sha256:52274c57ce4dee3b49db7a7ff708c040f771898b3be88725a86fb4430182fe14
	Public Key ID:
		sha1:c2596d620a6852b636380f3567de3ec794d1c532
		sha256:450799901e36ce751fb0320815621189811c2a5ee71f0345c160ab9cc3096d57
	Public Key PIN:
		pin-sha256:RQeZkB42znUfsDIIFWIRiYEcKl7nHwNFwWCrnMMJbVc=

-----BEGIN CERTIFICATE-----
MIIEvjCCA6agAwIBAgIQBtjZBNVYQ0b2ii+nVCJ+xDANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0yMTA0MTQwMDAwMDBaFw0zMTA0MTMyMzU5NTlaME8xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxKTAnBgNVBAMTIERpZ2lDZXJ0IFRMUyBS
U0EgU0hBMjU2IDIwMjAgQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAwUuzZUdwvN1PWNvsnO3DZuUfMRNUrUpmRh8sCuxkB+Uu3Ny5CiDt3+PE0J6a
qXodgojlEVbbHp9YwlHnLDQNLtKS4VbL8Xlfs7uHyiUDe5pSQWYQYE9XE0nw6Ddn
g9/n00tnTCJRpt8OmRDtV1F0JuJ9x8piLhMbfyOIJVNvwTRYAIuE//i+p1hJInuW
raKImxW8oHzf6VGo1bDtN+I2tIJLYrVJmuzHZ9bjPvXj1hJeRPG/cUJ9WIQDgLGB
Afr5yjK7tI4nhyfFK3TUqNaX3sNk+crOU6JWvHgXjkkDKa77SU+kFbnO8lwZV21r
eacroicgE7XQPUDTITAHk+qZ9QIDAQABo4IBgjCCAX4wEgYDVR0TAQH/BAgwBgEB
/wIBADAdBgNVHQ4EFgQUt2ui6qiqhIx56rTaD5iyxZV2ufQwHwYDVR0jBBgwFoAU
A95QNVbRTLtm8KPiGxvDl7I90VUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQG
CCsGAQUFBwMBBggrBgEFBQcDAjB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGG
GGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBABggrBgEFBQcwAoY0aHR0cDovL2Nh
Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNydDBCBgNV
HR8EOzA5MDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRH
bG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwCwYJYIZIAYb9bAIBMAcGBWeBDAEB
MAgGBmeBDAECATAIBgZngQwBAgIwCAYGZ4EMAQIDMA0GCSqGSIb3DQEBCwUAA4IB
AQCAMs5eC91uWg0Kr+HWhMvAjvqFcO3aXbMM9yt1QP6FCvrzMXi3cEsaiVi6gL3z
ax3pfs8LulicWdSQ0/1s/dCYbbdxglvPbQtaCdB73sRD2Cqk3p5BJl+7j5nL3a7h
qG+fh/50tx8bIKuxT8b1Z11dmzzp/2n3YWzW2fP9NsarA4h20ksudYbj/NhVfSbC
EXffPgK2fPOre3qGNm+499iTcc+G33Mw+nur7SpZyEKEOxEXGlLzyQ4UfaJbcme6
ce1XR2bFuAJKZTRei9AqPCCcUZlM51Ke92sRKw2Sfh3oius2FkOH6ipjv3U/697E
A7sKPPcw7+uvTPyLNhBzPvOk
-----END CERTIFICATE-----