Yuuki's Blog

TL;DR#

HTTPS certificates are digital certificates used to secure the transmission of website data, primarily through identity verification and data encryption. Certificate types include DV SSL, OV SSL, and EV SSL, each with its own use cases and features. Browsers check the validity of certificates through a series of steps and use the public key in the certificate for encrypted communication. Additionally, we can manually obtain and check a website's HTTPS certificate using command-line tools to inspect the Common Name (CN) and Subject Alternative Name (SAN) of the website.

What is an HTTPS certificate?#

An HTTPS certificate, also known as an SSL certificate or CA certificate, is a digital certificate used to secure the transmission of website data. This certificate ensures that data exchanged between users and the website cannot be intercepted or tampered with by third parties. Additionally, browsers can verify the authenticity and reliability of the website by checking the certificate.

What is the purpose of an HTTPS certificate?#

The purpose of an HTTPS certificate is primarily twofold:

1. Identity verification: HTTPS certificates contain information about the website's identity. When a user visits a website with an HTTPS certificate, the browser checks the validity of the certificate. If the certificate is valid, the browser displays that the page is secure. If the certificate is invalid or tampered with, the browser issues a warning to the user.
2. Data encryption: HTTPS certificates establish an encrypted communication channel between the user's browser and the server, ensuring that data transmitted cannot be intercepted or tampered with by third parties, thus effectively protecting the user's privacy.

What are the types of HTTPS certificates?#

The main types of HTTPS certificates are: DV SSL certificates (Domain Validation), OV SSL certificates (Organization Validation), and EV SSL certificates (Extended Validation).

The descriptions of different certificate types in Alibaba Cloud are as follows:

OV (Organization Validation) Certificate

• OV certificates are the preferred choice for enterprise SSL certificates, ensuring the authenticity of enterprise SSL certificates through enterprise authentication and rejecting website risks.
• OV certificates support the issuance of special domain names, such as gov, edu, .gov, .org, .jp (country abbreviation), etc.
• OV certificates support certificate merging, where multiple certificates (domains) can be combined and issued.

DV (Domain Validation) Certificate

• DV certificates are generally used for personal websites/testing purposes. DV certificates are issued quickly and do not require manual review, provided that the domain validation information is correct. They can be issued within 1-15 minutes.
• DV certificates cannot be issued for special domain names/public IP addresses (e.g., domains with edu, .gov, .org, .jp (country abbreviation) suffixes).
• DV certificates cannot merge multiple domains into a single certificate.

EV (Extended Validation) Certificate

• EV certificates are the highest level of password security, trust level, and authority level, ensuring the secure transmission of website data without leakage.
• Advantages: Prevents unauthorized application for certificates.

How do browsers check HTTPS certificates?#

When we visit a website, the browser's process of checking the website's certificate typically involves the following steps:

1. Requesting the certificate: When you visit an HTTPS website, your browser requests its HTTPS certificate from the website.
2. Checking the issuer: The browser checks if the certificate issuer is a trusted certificate authority. If not, the browser displays a warning.
3. Verifying the certificate: The browser verifies the validity of the certificate, including checking if the certificate has expired and if the domain name in the certificate matches the domain name of the website you are visiting.
4. Using the public key: If the certificate is valid, the browser uses the public key in the certificate to encrypt the information you send to the website. The website uses the corresponding private key to decrypt the information.

What is the domain name of a certificate?#

The domain name of a certificate, also known as the Common Name (CN) or Subject Alternative Name (SAN), is an important part of an HTTPS certificate. It indicates which website the certificate is issued for.

The Common Name (CN) is the primary identifier of the certificate and is typically the hostname protected by the certificate, such as www.example.com. In earlier SSL certificates, the Common Name was the only field used to identify the domain protected by the certificate, and there could only be one value for the Common Name.

However, as the internet evolved, a certificate may need to protect multiple domain names, which introduced the Subject Alternative Name (SAN). SAN is an extension field that can contain one or more domain names or subdomains. For example, a certificate's SAN can include example.com, www.example.com, and mail.example.com, allowing the certificate to protect these three domain names.

What are the types of certificate domain names?#

The domain names of HTTPS certificates mainly fall into the following types:

1. Single-domain SSL certificates: These certificates can only protect a specific domain and cannot protect other domains. For example, if the CN or SAN of a certificate includes example.com, the certificate can only protect the example.com website.
2. Multi-domain SSL certificates: These certificates can protect multiple domains, which need to be listed in the Subject Alternative Name (SAN) of the certificate. For example, if the SAN of a certificate includes www.example.com, example.com, and sub.example.com, the certificate will protect these three websites.
3. Wildcard SSL certificates: These certificates can protect a main domain and all its first-level subdomains, but cannot protect second-level or deeper subdomains. For example, if *.example.com is included in the CN or SAN, the certificate can protect the example.com domain and all its first-level subdomains.

Manually checking a website's HTTPS certificate#

In Unix-based operating systems, we can use the following command to obtain the SSL certificate of a target website:

website=example.com
echo | openssl s_client -servername $website -connect $website:443 2>/dev/null | openssl x509 -noout -text

In this command:

• The openssl s_client -servername $website -connect $website:443 part starts an SSL/TLS client and connects to the specified website on port 443 (the default port for HTTPS). The -servername parameter is used to specify the Server Name Indication (SNI), a TLS extension used to send the server name during the handshake phase.
• The 2>/dev/null part redirects error messages to /dev/null, meaning that error messages will not be displayed.
• The openssl x509 -noout -text part parses the certificate information obtained from the s_client command. The -noout parameter indicates that the encoded certificate will not be output, and the -text parameter displays the detailed information of the certificate in text format.

If the target website uses an HTTPS certificate, this command will return detailed information about the certificate, including its version, serial number, signature algorithm, issuer, validity period, subject, public key information, and extension fields.

Checking the Common Name and Subject Alternative Name of a certificate#

To find the Common Name of the certificate, look for the Subject: line in the output of the above command.

To find the Subject Alternative Name (SAN) of the certificate, look for the X509v3 Subject Alternative Name: line in the output.

Obtaining the fingerprint of a certificate#

When we need to obtain a unique identifier for a certificate, we often use the certificate's fingerprint. The fingerprint of a certificate is obtained by applying a specific hash algorithm (such as SHA-256) to the DER-encoded certificate (a binary format). You can view the SHA-256 fingerprint of a certificate using the following command:

website=example.com
echo | openssl s_client -servername $website -connect $website:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256

This command will return output similar to SHA256 Fingerprint=XX:XX:XX:..., where XX:XX:XX:... is the SHA-256 fingerprint of the certificate, serving as a unique identifier. Each certificate has a unique fingerprint, even if other information such as the subject or issuer is the same. Therefore, fingerprints can be used to uniquely identify a certificate. If two certificates have the same fingerprint, they are identical.