Root cert fingerprint = A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B Root cert fingerprint = 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33
savannah.gnu.org:
MD5 Fingerprint: 5E:DA:BC:84:B0:4C:D2:F0:8F:D2:FD:D9:2F:23:83:8A
SHA1 Fingerprint: 60:38:87:1C:A4:69:83:54:17:64:05:04:15:21:FA:37:07:3F:69:90
Public Key ID: 06:0F:24:8F:BF:01:EC:E8:7C:23:65:82:35:C7:98:D9:5F:C2:11:E7
savannah.nongnu.org:
MD5 Fingerprint: 1F:93:9D:AB:5E:C2:10:00:E6:82:B7:F9:A5:E2:2D:BE
SHA1 Fingerprint: E9:B4:EE:4E:07:36:97:18:BF:3A:1F:E0:70:0C:08:6B:92:61:67:30
Public Key ID: 52:8B:42:B7:FA:F5:92:23:88:C2:C4:70:A3:A8:E6:35:D4:32:5A:1E
Get GnuTLS and its
certtool utility [doc].
(Debian package: gnutls-bin, Fedora package: gnutls-utils):
$ certtool --certificate-info --infile savannah.gnu.org.pem
[...]
Other information:
MD5 Fingerprint: XX:XX:XX:...
[...]
# shorter version: certtool -i < savannah.gnu.org.pem
We'll use gnutls-cli [doc]:
$ gnutls-cli --x509cafile /usr/share/ca-certificates/cacert.org/cacert.org.crt savannah.gnu.org Processed 2 CA certificate(s). Resolving 'savannah.gnu.org'... Connecting to '199.232.41.3:443'... - Ephemeral Diffie-Hellman parameters - Using prime: 1032 bits - Secret key: 1015 bits - Peer's public key: 1032 bits - Certificate type: X.509 - Got a certificate list of 1 certificates. - Certificate[0] info: # The hostname in the certificate matches 'savannah.gnu.org'. # valid since: Sat Sep 13 15:30:50 CEST 2008 # expires at: Thu Mar 12 14:30:50 CET 2009 # fingerprint: E2:5B:1B:B0:CF:54:57:36:CB:84:B4:A9:6F:8F:C8:2D <-- verify the MD5 fingerprint # Subject's DN: CN=savannah.gnu.org # Issuer's DN: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org - Peer's certificate is trusted <-- check this line [...]
$ gnutls-cli --print-cert savannah.gnu.org </dev/null >sv.pem
You then can display the certificate as usual:
$ certtool -i < sv.pem
$ cat sv.pem /usr/share/ca-certificates/cacert.org/cacert.org.crt | certtool -e Certificate[0]: CN=savannah.gnu.org Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Verifying against certificate[1]. Verification output: Verified. Certificate[1]: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Verifying against certificate[2]. Error: Issuer's name: O=CAcert Inc.,OU=http://www.CAcert.org,CN=CAcert Class 3 Root certtool: Issuer's name does not match the next certificateThe first paragraph indicates that the key does validate against CAcert's root certificate. The second one show a slight inconsistency in the CAcert canonical name.