{"id":23053983,"url":"https://github.com/emcecs/ssl-certificate-extractor","last_synced_at":"2025-08-15T05:31:22.915Z","repository":{"id":145106387,"uuid":"66746473","full_name":"EMCECS/ssl-certificate-extractor","owner":"EMCECS","description":"Utility to analyze the certificates presented by an SSL server and identify the root certificate required.","archived":false,"fork":false,"pushed_at":"2016-08-28T03:39:24.000Z","size":57,"stargazers_count":17,"open_issues_count":0,"forks_count":15,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-04-03T07:37:55.308Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EMCECS.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-08-28T02:59:15.000Z","updated_at":"2024-11-24T22:25:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"f602518e-36f4-4f7e-8aed-68ceeb571e5a","html_url":"https://github.com/EMCECS/ssl-certificate-extractor","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/EMCECS/ssl-certificate-extractor","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EMCECS%2Fssl-certificate-extractor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EMCECS%2Fssl-certificate-extractor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EMCECS%2Fssl-certificate-extractor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EMCECS%2Fssl-certificate-extractor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EMCECS","download_url":"https://codeload.github.com/EMCECS/ssl-certificate-extractor/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EMCECS%2Fssl-certificate-extractor/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270527676,"owners_count":24600913,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-15T02:00:12.559Z","response_time":110,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-16T00:32:23.732Z","updated_at":"2025-08-15T05:31:22.899Z","avatar_url":"https://github.com/EMCECS.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SSL Server Certificate Utility\nWhen dealing with SSL servers inside enterprises, you will see a lot of self-signed certificates and internal CAs.\nSometimes it's difficult for users to understand what certificate is required to properly trust the server.  This\nutility will connect to the server and analyze the certificate chain presented and identify the root certificate\nneeded to trust the server.  The root certificate (if found) will then be stored in a file for later use.  If the\nroot certificate cannot be found, the DN (Distinguished Name) of the certificate will be printed so the user can \nlocate the correct root certificate elsewhere (usually an enterprise CA).\n\nThe application will also analyze the chain presented from the server and identify any issues it finds in the chain, \ne.g. the chain's certificates are not in the correct order.\n\nFinally, there is also an option to supply a root certificate to validate the chain for situations where Java does not\nhave the root CA certificate installed by default.\n\n# Usage\nIn its basic form, you run the JAR and connect to a host:port using the --connect argument, e.g.\n\n```\n$ java -jar ssl-certificate-extractor.jar -connect object.ecstestdrive.com:443\nLoading Java's root certificates...\nConnecting to object.ecstestdrive.com:443\nConnected? true\nCertificate: \n  Subject: CN=*.object.ecstestdrive.com, OU=Advanced Software Division, O=EMC, L=Bedford, ST=Massachusetts, C=US\n  Issuer : CN=thawte SHA256 SSL CA, O=\"thawte, Inc.\", C=US\nCertificate: \n  Subject: CN=thawte SHA256 SSL CA, O=\"thawte, Inc.\", C=US\n  Issuer : CN=thawte Primary Root CA - G3, OU=\"(c) 2008 thawte, Inc. - For authorized use only\", OU=Certification Services Division, O=\"thawte, Inc.\", C=US\nThe server sent 2 certificates\nThe root certificate appears to be CN=thawte Primary Root CA - G3, OU=\"(c) 2008 thawte, Inc. - For authorized use only\", OU=Certification Services Division, O=\"thawte, Inc.\", C=US\n  the server didn't send the CA cert (normal), but Java recognizes it as trusted.\n\nWrote root certificate to root.pem\n```\n\nIf the root certificate cannot be found in Java's keystore (cacerts), a message will be printed with the proper\ncertificate name: \n\n```\n$ java -jar ssl-certificate-extractor.jar -connect www.google.com:443 \nLoading Java's root certificates...\nConnecting to www.google.com:443\nConnected? true\nCertificate: \n  Subject: CN=www.google.com, O=Google Inc, L=Mountain View, ST=California, C=US\n  Issuer : EMAILADDRESS=webfilteradmin@emc.com, CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, L=Southborough, ST=Massachusetts, C=US\nCertificate: \n  Subject: EMAILADDRESS=webfilteradmin@emc.com, CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, L=Southborough, ST=Massachusetts, C=US\n  Issuer : CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, C=US, EMAILADDRESS=webfilteradmin@emc.com\nThe server sent 2 certificates\nThe root certificate appears to be CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, C=US, EMAILADDRESS=webfilteradmin@emc.com\n  and Java doesn't have this certificate as a trusted certificate.  This may happen if you're not using a common CA (Certificate Authority) or your organization runs its own CA.  Please contact your security administrator and tell them you're looking for the root certificate for CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, C=US, EMAILADDRESS=webfilteradmin@emc.com\n```\n\nOnce you've located the proper root certificate, you can verify it with the --verify option, e.g. \n\n```\n$ java -jar ssl-certificate-extractor.jar -connect www.google.com:443 --verify emcssl.pem \nLoading Java's root certificates...\nLoading your certificate from: ../../emcssl.pem\nConnecting to www.google.com:443\nConnected? true\nCertificate: \n  Subject: CN=www.google.com, O=Google Inc, L=Mountain View, ST=California, C=US\n  Issuer : EMAILADDRESS=webfilteradmin@emc.com, CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, L=Southborough, ST=Massachusetts, C=US\nCertificate: \n  Subject: EMAILADDRESS=webfilteradmin@emc.com, CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, L=Southborough, ST=Massachusetts, C=US\n  Issuer : CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, C=US, EMAILADDRESS=webfilteradmin@emc.com\nThe server sent 2 certificates\nThe root certificate appears to be CN=EMC SSL Decryption Authority, OU=Global Security Organization, O=EMC Corporation, C=US, EMAILADDRESS=webfilteradmin@emc.com\n  and Java doesn't have this certificate as a trusted certificate.  However, the certificate you passed to verify IS the correct root certificate!\n\nWrote root certificate to root.pem\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Femcecs%2Fssl-certificate-extractor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Femcecs%2Fssl-certificate-extractor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Femcecs%2Fssl-certificate-extractor/lists"}