Un certificat SSL est un fichier de données qui lie une clé cryptographique aux informations d’une organisation ou d’un individu. Installé sur un serveur web, le certificat active le cadenas et le protocole « https » (via le port 443) dans les navigateurs, afin d’assurer une connexion sécurisée entre le serveur web et le navigateur.

Généralement, le SSL est utilisé pour sécuriser les transactions bancaires, le transfert de données et les informations de connexions, telles que les noms d’utilisateur et les mots de passe. Récemment, le TLS (successeur du SSL) est devenu la norme pour sécuriser l’utilisation de sites de réseaux sociaux. Les certificats SSL lient ensemble :

  • Un nom de domaine, un nom de serveur et un nom d’hôte.
  • L’identité de l’organisation (nom d’entreprise) et le lieu.

Afin de vérifier sa validité, voici la commande à exécuter :

openssl x509 -in certificat.rsa.crt -text | grep Not

 

Not Before: Jun 14 11:22:15 2019 GMT

Not After : Jun 13 11:22:15 2020 GMT

Not Before : Installer le 14 juin 2019

Not After : Périme le 13 juin 2020

Pour voir le domaine concerné par le certificat :

openssl x509 -in certificat.crt -text | grep DNS

 

DNS:*.certificat.fr, DNS:certificat.fr

Vérifier le hash :

openssl x509 -noout -modulus -in certificat.crt | 
openssl md5 && openssl rsa -noout -modulus -in certificat.key | openssl md5

 

(stdin)= 7835ec3b7f61346018f92ec16bccf4ef

(stdin)= 7835ec3b7f61346018f92ec16bccf4ef

Si les hash sont identiques sur les 2 lignes, alors le certificat sera valide.

Vérifier un certificat :

openssl x509 -in certificat.crt -text -noout

 

 

 

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

8c:05:8a:7c:23:d9:a8:cd

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = FR, ST = Bouche Du Rhone, L = Marseille, 
O = Jaguar Network, OU = CsC, CN = jaguarnetwork.jn-hebergement.com, 
emailAddress = test@test.com

Validity

Not Before: Jun 14 11:34:54 2019 GMT

Not After : Jun 13 11:34:54 2020 GMT

Subject: C = FR, ST = Bouche Du Rhone, L = Marseille, 
O = Jaguar Network, OU = CsC, CN = jaguarnetwork.jn-hebergement.com, 
emailAddress = teest@test.com

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (4096 bit)

Modulus:

00:ae:34:69:a4:60:7d:d3:73:a9:7b:e0:1c:8f:4d:

8d:ef:db:bd:c1:62:c9:f9:37:fa:14:c3:96:41:8d:

dc:35:a9:9b:6d:a5:ab:bf:27:ab:92:8c:65:60:bd:

bb:96:d4:2c:20:03:2c:c4:a1:56:0d:c9:1c:29:cd:

35:30:84:2f:9a:49:3c:fc:b2:92:d0:7d:02:33:af:

00:5d:bc:a0:f7:a8:bf:62:37:2c:b2:23:eb:04:73:

8d:5f:04:07:ee:84:23:33:41:fc:cc:3b:04:c4:4e:

3d:81:3d:71:03:e1:48:10:f9:ec:44:25:61:9d:8f:

e6:4d:5c:02:b4:5e:a9:2c:bb:cf:15:5b:99:48:6f:

63:ee:71:70:3f:39:fa:bb:cc:59:00:e8:78:1a:fc:

4b:85:5a:ee:da:10:3b:27:04:8c:aa:8c:f2:33:f3:

0e:10:7a:2c:0c:83:9b:b2:2c:49:a1:4d:b9:27:42:

8a:41:52:0f:1b:4b:34:4d:b8:5e:50:ec:f2:6b:d6:

10:05:c2:2b:14:92:24:17:45:5b:0e:2c:4e:6b:4a:

7c:fa:13:29:ee:3e:42:a9:f6:b4:d6:0a:fc:b9:84:

81:d7:b9:ca:a7:fe:24:8e:b9:bf:d5:48:e9:9c:08:

af:b7:d1:e8:60:fc:33:a2:4d:5d:41:87:06:ac:e4:

72:59:a1:ea:bc:55:ab:93:6e:ec:48:08:d8:f0:49:

c1:c8:ea:7c:e8:ca:ac:24:78:48:b7:ee:f0:d1:06:

53:c5:a7:6f:c6:f2:ab:da:9e:ac:a2:73:84:05:b5:

b1:f7:28:ff:fb:38:12:b3:2a:15:78:c8:b7:74:a7:

09:70:ef:8a:18:1d:ea:94:d4:23:25:b6:b5:e4:0d:

df:d9:83:d7:76:b1:64:fe:c7:bd:47:69:b1:6b:8a:

6a:f5:59:da:80:9b:0e:6d:2f:86:5c:d5:af:4f:7f:

89:35:6f:a2:47:4d:ef:a9:74:6d:a4:e4:df:95:84:

e6:88:f5:b4:ab:47:c3:59:88:06:99:60:fb:2e:f0:

9c:c7:70:7f:5f:23:47:3a:49:c6:d7:aa:24:f8:44:

58:cb:69:8b:f8:ae:63:69:36:b5:c5:36:c0:31:b1:

43:89:ad:67:7d:39:48:42:05:51:72:2b:0a:48:80:

c2:e5:1f:c6:63:4f:9e:93:b4:d0:ae:c6:89:08:e0:

c9:a2:ad:2f:fc:18:68:30:ff:9e:ff:5a:35:4b:68:

f7:83:87:7a:36:1f:2e:d6:0f:13:40:27:9a:c2:01:

91:78:c2:8f:56:51:36:01:e6:27:47:f8:7a:31:fa:

42:8b:89:88:64:e0:d6:24:53:0f:ce:37:4b:91:8d:

82:98:21

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Subject Key Identifier:

4F:C0:95:F3:B6:5E:0F:EC:71:02:28:BE:C9:1E:47:25:DE:40:3D:66

X509v3 Authority Key Identifier:

keyid:4F:C0:95:F3:B6:5E:0F:EC:71:02:28:BE:C9:1E:47:25:DE:40:3D:66

 

X509v3 Basic Constraints: critical

CA:TRUE

Signature Algorithm: sha256WithRSAEncryption

67:5c:d2:6b:a4:8d:67:cb:93:df:ae:bc:ef:33:b8:3e:7d:8b:

a1:94:31:fc:cf:58:b3:29:43:87:9a:a5:98:2b:e5:15:d5:ff:

89:50:45:40:5c:40:32:e3:b8:96:a2:11:17:e3:c8:15:7e:3c:

73:88:11:da:f9:c2:bc:22:17:41:69:19:33:d2:5e:9a:55:a0:

32:25:35:9a:06:2e:25:33:57:08:0d:7a:92:51:3f:3c:7e:20:

a4:b2:a0:bb:67:4d:16:fc:48:df:84:53:92:41:6e:56:91:20:

d7:0c:26:f0:4f:b7:38:d2:c8:17:39:b3:49:27:aa:29:cf:79:

5b:f5:df:0c:2d:68:9a:ea:be:bb:68:50:57:c0:b8:7a:e4:dd:

3e:ec:24:45:2b:1f:b4:c8:40:c7:12:f5:63:e1:27:c5:61:dd:

5c:b4:ed:6a:28:e2:d3:75:87:76:6c:10:14:71:7b:dd:58:60:

87:50:b7:6b:d3:4f:27:df:1d:0a:a3:6a:1d:1a:9d:ae:f5:aa:

0f:61:b6:2c:8f:d6:29:2f:41:8d:fd:a8:97:8c:34:15:75:52:

5b:b5:ea:76:5c:27:64:13:ff:fa:0c:39:c7:14:31:fa:46:a0:

f6:9c:1a:48:a5:ec:74:d8:3b:85:8a:42:ac:6e:d2:03:24:21:

f4:f4:a9:dd:a5:7c:a5:e2:a6:a0:d1:21:86:41:30:5f:8a:96:

0b:6a:47:12:60:0b:2e:a6:ad:b1:89:c2:4f:37:f1:4e:93:1d:

e8:79:87:24:11:5c:28:c4:bb:42:78:12:2a:3a:44:e6:62:e8:

7c:d1:d5:f7:a6:13:dc:e2:70:aa:11:bc:44:cf:d8:b4:c4:50:

af:c5:2f:ab:d2:e2:b4:e4:5d:74:7b:01:98:85:fa:33:62:ad:

6d:17:f5:d8:2e:a0:2f:60:b0:ac:5e:17:96:cd:35:42:42:c2:

96:f5:4a:b3:d7:70:17:3d:b4:83:a5:7c:cd:e2:6c:10:6d:cb:

d1:dd:d8:ac:85:74:c2:0c:a7:8d:f8:12:b4:79:09:fe:15:bd:

38:ba:f9:21:fe:fb:2d:4d:29:a0:54:2f:b9:f4:ce:38:45:52:

a0:3d:63:2e:06:27:4f:11:0b:ea:d1:81:80:38:26:d4:b5:2d:

34:3b:21:69:df:e3:8a:15:16:87:7e:f6:4d:d5:ab:b5:b8:54:

fc:a2:85:b6:39:87:e7:7e:33:37:4d:3a:71:27:d3:95:06:2b:

9b:12:51:a3:29:cc:8d:f2:8e:3b:1e:3d:ac:b9:f7:e2:a9:60:

10:b9:93:9f:fb:e4:d4:22:a6:f7:3e:aa:a6:a9:e1:13:d4:c6:

34:b9:52:42:16:f4:53:05

 Vérifier une clé privée :

openssl rsa -in server.key -check<:pre>

 

Tester si tout fonctionne :

openssl s_client -connect www.jaguarnetwork.com:443

CONNECTED(00000003)

depth=2 C = GB, ST = Greater Manchester, L = Salford, 
O = COMODO CA Limited, CN = COMODO RSA Certification Authority

verify return:1

depth=1 C = GB, ST = Greater Manchester, L = Salford, 
O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA

verify return:1

depth=0 OU = Domain Control Validated, CN = *.jaguar-network.com

verify return:1

---

Certificate chain

0 s:/OU=Domain Control Validated/CN=*.jaguar-network.com

i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO 
RSA Domain Validation Secure Server CA

1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO 
RSA Domain Validation Secure Server CA

i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO 
RSA Certification Authority

2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO 
RSA Certification Authority

i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

---

Server certificate

-----BEGIN CERTIFICATE-----

MIIHxzCCBq+gAwIBAgIQMNKhebYRBUDnZc3KnpMbwDANBgkqhkiG9w0BAQsFADCB

kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G

A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNV

BAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD

QTAeFw0xODEwMjQwMDAwMDBaFw0yMDEwMjMyMzU5NTlaMEIxITAfBgNVBAsTGERv

bWFpbiBDb250cm9sIFZhbGlkYXRlZDEdMBsGA1UEAwwUKi5qYWd1YXItbmV0d29y

ay5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC3fwr+SU6TOhLV

Ca0Ig+L2YSjR9pD38NhQ09vgB37rvNBfgECG6cixrEgpg+PQK1Oio/x5kdrT+10F

EUEsML0cKBhscts3S3iPs+mOXPfB3zImXy7FgA7aS6GRMemM9D+SucIqzJT3Ya2j

dvpX5lSzKSSvuXOWFhGEsVO2zvb+boFdZAv9uZfYRVs4f6q9CYFr7XguKvYTa/sn

WzMPIwFfIdEL/VYDt3q2pgQUgXqUn66Z+k/J+N/gWqd6Zc2BaNJlbpQgpvu2cLui

OZgVfN7Up1ps2ZISEwg3CjgG4iPU2hYwPvcXD3uROOGUKfD70/TZDOlecklhAKXc

OJwcjzbJpJTsbfsO+31JADjVbRn6czYszsfMH11he+N9M9jYMzB2ThVqZLt1Wzce

I3MpXIUXq8KLuXFfx+kjhnutYZ8OaKpI6E+qkJ+8T/4722v0tlcdXAkXH6LpgTjV

BCKdoSE4DJgaqNXHUFsJRaqWyWHCMCz9ae1bzEA68p3T20Jp3f51PaS67sbGabcy

OUqyVT5Dc6DN9HDwZmE6/FUls+iVRsK8SLzW8OnSpcuWmDXJWvVVHH88isUPQQjA

2j3/DWsjncabbXGiCxlrhB021HAZVcSSHRMGO5TOlkTNNx8x6KypbCxZl93tdHzP

TGigWl2++Z/vJmrFPwXG0rJuMzLSJwIDAQABo4IDaDCCA2QwHwYDVR0jBBgwFoAU

kK9qOpRaC9iQ6hJWc99DtDoo2ucwHQYDVR0OBBYEFCH20kHLlyxfydPe/7rkZQNK

6TypMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsG

AQUFBwMBBggrBgEFBQcDAjBPBgNVHSAESDBGMDoGCysGAQQBsjEBAgIHMCswKQYI

KwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5jb20vQ1BTMAgGBmeBDAEC

ATBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01P

RE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3JsMIGFBggrBgEF

BQcBAQR5MHcwTwYIKwYBBQUHMAKGQ2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NP

TU9ET1JTQURvbWFpblZhbGlkYXRpb25TZWN1cmVTZXJ2ZXJDQS5jcnQwJAYIKwYB

BQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAzBgNVHREELDAqghQqLmph

Z3Vhci1uZXR3b3JrLmNvbYISamFndWFyLW5ldHdvcmsuY29tMIIBfwYKKwYBBAHW

eQIEAgSCAW8EggFrAWkAdgDuS723dc5guuFCaR+r4Z5mow9+X7By2IMAxHuJeqj9

ywAAAWallGJmAAAEAwBHMEUCIQDrhkRmJQTaZCJtyI+6kVhWrR3bd4KPNPgdn7M4

riD7eQIgDQqnGfYx7Ef9AtnWglKYL5Pu8RUrUB1ntM3Zy34//IYAdgBep3P531bA

57U2SH3QSeAyepGaDIShEhKEGHWWgXFFWAAAAWallGKLAAAEAwBHMEUCIQDTTkiQ

n8JHehmoq38SyEp4h2V8WB0QzLzX8G+dPQHWlQIgeWZreUmUuShDWfZnv5lrgdtN

8ynkTWYC4eYhKTVj/CsAdwCyHgXMi6LNiiBOh2b5K7mKJSBna9r6cOeySVMt74uQ

XgAAAWallGJiAAAEAwBIMEYCIQDGu8q4nLZVu2Bzc9Y/WAWMbPptszlp5X0kld0k

ZeJqhgIhAIBzcMFXJbP5KF48jXnC8Gf+kdxixyh1RBG22ajYhMHFMA0GCSqGSIb3

DQEBCwUAA4IBAQCKLfRsNG1pnLXKh3ho0Oue7JS9TwUcU62ehYg5AuuqcECYZNXW

ySBD3oBSBZtB+VYGcLT59f+PjuUloPAEIrDS/bTOXTZlCEMZE8cRp0QorvMBrPZM

8ZIVwzoaiAdmgNdcf98JWFhZJnxxmmxRV2/kyyi3Bn9+aDhUaweuIIIwSMo5CF/n

mXFH+bE95yv4WYq+LoYkVioSidjVvZccM64S0l6nyN9tAgTcDm2arGb16SOURtF1

MULDO6AOHSPbzUtGE8Rs/wo/vQGc0p9VlI4cn3edOSlHEkNdFbzN8+pwDMa29yd6

9+G2nHB+O+po9clJsqvPbnECV0GVVeRc1idH

-----END CERTIFICATE-----

subject=/OU=Domain Control Validated/CN=*.jaguar-network.com

issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO 
RSA Domain Validation Secure Server CA

---

No client certificate CA names sent

Peer signing digest: SHA512

Server Temp Key: ECDH, P-256, 256 bits

---

SSL handshake has read 5712 bytes and written 302 bytes

Verification: OK

---

New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384

Server public key is 4096 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

No ALPN negotiated

SSL-Session:

Protocol  : TLSv1.2

Cipher    : ECDHE-RSA-AES256-GCM-SHA384

Session-ID: 566C264B96E97541C6B8F1338CB1E6C63813E1EE0D82A47F1592C33C7D60A733

Session-ID-ctx:

Master-Key: 
82713D315EAD6F0685AF2EA9BCBDB585651B1B23D061ADE214C7221F7686C1BC2C049CBC1D15C04DD7DB17E1F403D602

PSK identity: None

PSK identity hint: None

SRP username: None

Start Time: 1567175284

Timeout   : 7200 (sec)

Verify return code: 0 (ok)

Extended master secret: no

Pour vérifier la configuration avant de reload le service apache / nginx :

apache2ctl -t

nginx -t

 

ATTENTION : Cela ne teste que la bonne syntaxe de la configuration et non la validité des certificats.