从“openssl s_client”的输出中提取证书

Question

我想获取 http 站点证书链的所有证书。使用 openssl 连接到 http 站点并将输出存储到文件out.txt：

openssl s_client -connect www.openssl.org:443 -showcerts > out.txt

out.txt的内容如下所示。它包含两个证书：

...
 0 s:CN = www.openssl.org
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
-----BEGIN CERTIFICATE-----
MIIFVTCCBD2gAwIBAgISAwk9QUiwVmoQAtcCLKybaK7yMA0GCSqGSIb3DQEBCwUA
...
mQBom1EISBOiNyu5koR6iRZcXsn6x/4kwA==
-----END CERTIFICATE-----
 1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
...
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----
---
...

现在我想将每个证书存储在以扩展名 .cer结尾的文件中。对于上面的示例，应创建文件Let's Encrypt Authority X3.cer和www.openssl.org.cer 。

使用命令openssl x509我只能存储out.txt中包含的第一个证书。

cat out.txt | openssl x509 > www.openssl.org.cer

但我想存储out.txt中包含的所有证书，而不仅仅是第一个证书。

这可以用openssl以某种方式完成吗？或者用awk？

Answer 1

是的，这可以用 awk 来完成。我想一点一点地介绍我的解决方案。

第 1 步：提取“BEGIN CERTIFICATE”和“END CERTIFICATE”之间的所有内容

仅在“BEGIN CERTIFICATE”和“END CERTIFICATE”之间写入行以输出：

awk '
/BEGIN CERTIFICATE/,/END CERTIFICATE/ {
print $0
}
' out.txt

步骤2：提取包含CN的行

选择包含 CN 的行（例如 0 s:CN = www.openssl.org）

awk '
/^ [0-9]+ s:.*CN = / {
print $0
}
' out.txt

这会产生输出：

 0 s:CN = www.openssl.org
 1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3

步骤3：提取字段CN的内容

awk '
BEGIN {
# change field separator, so that $2 returns everything after "CN = "
FS="CN = "
}
# selects line which contains CN (e.g.  0 s:CN = www.openssl.org)
/^ [0-9]+ s:.*CN = / {
# use CN (e.g. www.openssl.org) as filename
print $2
}
' out.txt

这会产生输出：

www.openssl.org
Let's Encrypt Authority X3

第 4 步：完整解决方案

这将创建文件Let's Encrypt Authority X3.cer和www.openssl.org.cer：

awk '
BEGIN {
# change field separator, so that $2 returns everything after "CN = "
FS="CN = "
}
# selects line which contains CN (e.g.  0 s:CN = www.openssl.org)
/^ [0-9]+ s:.*CN = / {
# use CN (e.g. www.openssl.org) as filename
filename=$2".cer"
}
# write all lines between "BEGIN CERTIFICATE" and "END CERTIFICATE" to filename
/BEGIN CERTIFICATE/,/END CERTIFICATE/ {
print $0 > filename
}
' out.txt

AWK 文档： https://www.gnu.org/software/gawk/manual/html_node/index.html