openssl s_client使用代理

Question

openssl s_client -connect some.https.server:443 -showcerts

当您想要检查服务器的证书及其证书链时,这是一个很好的命令.

当您在HTTP/HTTPS代理后面时,有没有办法运行此命令？

Answer 1

您可以使用proxytunnel:

proxytunnel -p yourproxy:8080 -d www.google.com:443 -a 7000

然后你可以这样做:

openssl s_client -connect localhost:7000 -showcerts

希望这可以帮到你!

Answer 2

对于2015年5月之后来到这里的人来说:有一个新的"-proxy"选项将包含在openssl的下一个版本中:https://rt.openssl.org/Ticket/Display.html？id = 2651&user =客人&传=客

Answer 3

官方没有.

但这里有补丁http://rt.openssl.org/Ticket/Display.html?id=2651&user=guest&pass=guest

Answer 4

自openssl v1.1.0起

C:\openssl>openssl version
OpenSSL 1.1.0g  2 Nov 2017
C:\openssl>openssl s_client -proxy 192.168.103.115:3128 -connect www.google.com -CAfile C:\TEMP\internalCA.crt
CONNECTED(00000088)
depth=2 DC = com, DC = xxxx, CN = xxxx CA interne
verify return:1
depth=1 C = FR, L = CROIX, CN = svproxysg1, emailAddress = xxxx@xxxx.xx
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = www.google.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
   i:/C=xxxx/L=xxxx/CN=svproxysg1/emailAddress=xxxx@xxxx.xx
 1 s:/C=xxxx/L=xxxx/CN=svproxysg1/emailAddress=xxxx@xxxx.xx
   i:/DC=com/DC=xxxxx/CN=xxxxx CA interne
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDkTCCAnmgAwIBAgIJAIv4/hQAAAAAMA0GCSqGSIb3DQEBCwUAMFIxCzAJBgNV
BAYTAkZSMQ4wDAYDVQQHEwVDUk9JWDETMBEGA1UEAxMKc3Zwcm94eXNnMTEeMBwG