Checking public ssl certificate

Overview

Most of the cases, we need to check the ssl stream if the connection is funtioning properly or not. To do this, I suggest the two options below. In this post, I will use my exchange server certificate issued to “mail.cake.run.place”

0. Index

1. Using browser 1.1. Chrome 1.2 Edge
2. Using command 2.1 Curl 2.2 OpenSSL 2.3 PowerShell

1. Using browser

1.1 Chrome

1.2 Edge

2. Using command

2.1 Curl

Just simply execute this command from the terminal.

curl -v https://mail.cake.run.place

e.g.,

2.2 OpenSSL

openssl s_client -connect mail.cake.run.place:443 </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -fingerprint

e.g.,

2.3 PowerShell

1. More simple way

$request = [System.Net.HttpWebRequest]::Create("https://mail.cake.run.place")
$request.GetResponse()
$request.ServicePoint.Certificate.Issuer

e.g.,

• Ref: Requirements for AIP https://learn.microsoft.com/en-us/purview/rights-management-requirements#firewalls-and-network-infrastructure
• Ref: HttpWebRequest Class https://learn.microsoft.com/en-us/dotnet/api/system.net.httpwebrequest?view=net-9.0

1. More Classic way

$url = "mail.cake.run.place"
$port = 443

$tcp = [System.Net.Sockets.TcpClient]::new($url,$port)
$ssl = [System.Net.Security.SslStream]::new($tcp.GetStream(), $false, ({$true}))
$ssl.AuthenticateAsClient($url)

$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ssl.RemoteCertificate)
$cert | fl

$tcp.Close()
$ssl.Close()

e.g.,

• Ref: TcpClient Class https://learn.microsoft.com/en-us/dotnet/api/system.net.sockets.tcpclient?view=net-9.0
• Ref: SslStream Class https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslstream?view=net-9.0
• Ref:SslStream.AuthenticateAsClient Method https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslstream.authenticateasclient?view=net-8.0
• Ref: X509Certificate2 Class https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2?view=net-9.0

Result

For the AIP or entra id hybrid joined devices, you should bypass some urls from the ssl inspection. Or you might struggle to troubleshoot to resolve it. I hope you guys can debug using the options I suggest in this post.