Extracting Server Certificates Made Easy With Certificate Ripper

Introduction

As engineers, we sometimes need to grab a certificate for different purposes. It may occur that we need it to update the truststore of our application with a new trusted certificate, or just want to analyze the content of it, or use it for testing or just for some other purpose. There are multiple ways to accomplish this such as drag-and-drop the certificate from your browser to your desktop or by using OpenSSL. The browser is only capable of exporting binary certificates and the commands of OpenSSL might be sometimes complex or tricky to build depending on which kind of output you want. I was seeking a simple way of just printing server certificates to either a pem format or human-readable format and I also wanted to export all of it into a truststore file and in that way Certificate, Ripper came into life. 

Certificate Ripper is a CLI application available for Windows, Mac OS X, and Linux and can be found here: GitHub - Certificate Ripper

Demo

Advantages

• It is fast
• Easy to use
• No OpenSSL required
• Runs on any Operating System
• Can be used with or without Java, native executables are present in the releases
• Extracts all the sub-fields of the certificate
• Certificates can be formatted to PEM format
• Bulk extraction of multiple different URLs with a single command is possible
• Extracted certificates can be stored automatically into a p12 truststore

Installing and Usage

Mac OS X - Homebrew

brew tap hakky54/crip
brew install crip
crip print --url=https://dzone.com/

Windows

1. Download the latest binary here: Releases
2. Extract the compressed file
3. Start cmd and cd to the extracted file
4. Run start /b "" "crip.exe" print --url=https://dzone.com/

Linux

1. Download the latest binary here: Releases
2. Extract the compressed file
3. Add the reference to your environment variables: export CRIP_HOME=/path/to/crip
4. Run crip print --url=https://dzone.com/

Using Executable JAR

1. Download the latest JAR here: Releases
2. Run it with java -jar crip.jar print --url=https://dzone.com/

Printing Certificates

Certificates printed by default as human-readable (as far as possible) but can also be printed in pem format if specified like the example below:

crip print --url=https://dzone.com/ --format=pem

Exporting Certificate to a Truststore File

Certificates can be exported into a PKCS12/p12 type truststore if the export command is used as the example below:

crip export --url=https://dzone.com/

Bulk Extraction

The URL parameter can be repeated with different values to extract multiple servers with a single command for bulk extraction. This is possible for either printing or exporting. The below command will try to extract Facebook, youtube, GitHub, StackOverflow in one go!

crip export \
-u=https://youtube.com \
-u=https://github.com \
-u=https://stackoverflow.com \
-u=https://facebook.com

Conclusion

This was a small introduction to extracting server certificates with certificate ripper. See the Example usages section to learn about the other options to further customize your commands.