Obtaining ssl certificate on windows using C++

Question

I am trying to obtain a remote server's ssl certificate on windows. One option I have found is to use openssl. The command to do that as indicated by some posts on the internet is:

openssl.exe s_client -showcerts -connect {REMOTE_SERVER_IP}:{REMOTE_SERVER_PORT}

This works perfectly, but my problem is that the above command has a timeout of 300 seconds. The certificate itself gets printed pretty fast and I see no reason to wait 300 seconds when I get all I want in the first few seconds. Still I think there is no way to change the timeout parameter on s_client. So I tried to figure a way to kill a process on windows after a given period of time but again had no luck there. Any ideas on how can this be done? If there is some other windows way to a obtain a remote servers ssl certificate and store it in a file this will also do the job.

EDIT: as per Bruno's request adding more information. I am trying to create a c++ application that gets the SSL certificate of a remote server and stores it in a file for further processing. As my application already makes use of openssl.exe I either need a solution that uses openssl.exe or a standard windows command(i.e. does not require any additional libraries).

EDIT2: I have found a way to avoid the waiting in linux - just create an empty file and redirect the input of openssl s_client to it(or use pipe to pass empty input). This works on windows as well but with older versions of openssl(0.9.8l). I tried it with 0.9.8r and with 1.0.1b and redirecting the input to an empty file does not help there.

The command is started from a program. If I run it from the command line ctrl+c does the job but this is not what I need. — Ivaylo Strandjev, May 14 '12 at 10:34
So far, this looks like a SuperUser question (hence the votes to close). If you do run this from a program, please tell us how (and which language). — Bruno, May 14 '12 at 10:36
I have added some more information hope now it is more clear. — Ivaylo Strandjev, May 14 '12 at 10:43
openssl is a library as well. A solution would be to make the C-calls into libssl from C++, to obtain the certificate. You can use s_client as an example implementation. — mirk, May 15 '12 at 14:39
@mirk I reached the same conclusion after a lot of struggle with the command line tool. I will try to understand s_client and implement some minimal code that only obtains ssl certificate. — Ivaylo Strandjev, May 16 '12 at 06:11

score 8 · Accepted Answer · edited May 23 '17 at 12:09

Here is a minimalistic program I created that connects to a server and prints its ssl certificate to the standard output. Hope it will help someone else to resolve similar issue:

#ifdef WIN32
#include <windows.h>
#include <winsock2.h>
#else
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#endif

#include <openssl/ssl.h>    
#include <cstdlib>
#include <iostream>

static const char *host= "10.23.10.12";
static int port=443;

int tcp_connect(const char *host,int port)
{
#ifdef WIN32
   WSADATA wsaData;
   WORD version;
   int error;

   version = MAKEWORD( 2, 0 );

   error = WSAStartup( version, &wsaData );

   /* check for error */
   if ( error != 0 )
   {
       /* error occured */
       return -1;
   }

   /* check for correct version */
   if ( LOBYTE( wsaData.wVersion ) != 2 ||
        HIBYTE( wsaData.wVersion ) != 0 )
   {
       /* incorrect WinSock version */
       WSACleanup();
       return -1;
   }

   /* WinSock has been initialized */
#endif

   struct hostent *hp;
   struct sockaddr_in addr;
   int sock;

   if(!(hp=gethostbyname(host)))
      printf("Couldn't resolve host");
   memset(&addr,0,sizeof(addr));
   addr.sin_addr=*(struct in_addr*)
         hp->h_addr_list[0];
   addr.sin_family=AF_INET;
   addr.sin_port=htons(port);

   if((sock=(int)socket(AF_INET,SOCK_STREAM,
                   IPPROTO_TCP))<0)
      printf("Couldn't create socket");
   if(connect(sock,(struct sockaddr *)&addr,
              sizeof(addr))<0)
      printf("Couldn't connect socket");

   return sock;
}

int main(int argc,char **argv)
{
   SSL_CTX *ctx;
   SSL *ssl;
   BIO *sbio;
   int sock;

   SSL_METHOD *meth=NULL;
   meth=SSLv23_client_method();
   OpenSSL_add_ssl_algorithms();
   SSL_load_error_strings();
   ctx=SSL_CTX_new(meth);

   /* Connect the TCP socket*/
   sock=tcp_connect(host,port);

   /* Connect the SSL socket */
   ssl=SSL_new(ctx);
   sbio=BIO_new_socket(sock,BIO_NOCLOSE);
   SSL_set_bio(ssl,sbio,sbio);

   if(SSL_connect(ssl)<=0)
     printf("SSL connect error");

   X509 *peer;
   peer=SSL_get_peer_certificate(ssl);
   PEM_write_X509(stdout, peer);

   SSL_CTX_free(ctx);

   close(sock);
#ifdef WIN32
   closesocket(sock);
   WSACleanup();
#else
   close(sock);
#endif
   exit(0);
}

The code is modified version of the examples found here as suggested by this post.

EDIT: I kept getting the error OPENSSL_UPLINK: no OPENSSL_APPLINK on windows. After a lot of searching around the internet I found this post and added this to my code:

extern "C" {
   #include <openssl/applink.c>
}

Seems this is some work around to avoid the requirement for compiler and run-time options compatibility.

can I use domain name of site for certificate extracting? (not ip address and port) f.e. "http://google.com" instead of "10.23.10.12" port=443 — BergP, Jul 17 '13 at 10:43
this code should work just fine. Notice this call: `gethostbyname(host)` it should try to resolve the hostname. — Ivaylo Strandjev, Jul 17 '13 at 10:49
can i get "ip address" and "port" from hostent struct that returned by gethostbyname(host)? — BergP, Jul 17 '13 at 10:54
sorry, now I understand, 443 - is https port, and host can be domain name. Thanks! — BergP, Jul 17 '13 at 11:46
How is it failing? Maybe it is better to post a separate question instead of discussing here. — Ivaylo Strandjev, Oct 14 '13 at 12:39

Obtaining ssl certificate on windows using C++

1 Answers1

Linked