How to obtain a remote X509 certificate?

Have you ever tried to obtain an X509 certificate from a remote site? This is quite required when you need to write a PHP client to securely access a web service using WSF/PHP. Or may be a Ruby client using WSF/Ruby.
Naaah...!!! this is not only for WSF or for web services stuff. But also if you need simply to encrypt locally and send the file as an attachment to a remote party via mail or to verify a signature of an attachment.
OK. This is how you do it. Simply enter the following command. Here we are going to obtain the google's certificate. Never forget to have openssl installed in your system.

echo | openssl s_client -connect 64.233.161.103:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cert.cert

Note that we are saving the file as cert.cert. You are free to use any file name.
OK. Now by simply replacing the ip address (64.233.161.103) from yours, you can obtain the X509 certificate of your desired site.

Create your own Certificate Authority using OpenSSL

In my earlier blog I showed how to generate a self signed certificate.
A self signed certificate is of no use as it is not signed by a third party. There are such well known third parties like verisign and thawte. But getting a certificate signed is a complex and costly process. If you need to form a small trust community (e.g. For your company or with your clients) you can create your own Certificate Authority. The process is not that complex as it sounds. Thanks to a pearl script available in OpenSSL distribution of cource. If you have used default installation settings, this script (CA.pl) can be located in /usr/lib/ssl/misc/CA.pl. First of all create a directory for you CA. Then copy CA.pl and /usr/lib/ssl/openssl.cnf to the directory you just created. Run the CA.pl script.

%./CA.pl -newca

If you press enter key, the script will create a new certificate/key pair for you. If you already have a certificate and you need to use it, just type the filename. Now you have a certificate authority setup in a sub directory called "demoCA". Simple, right? Let's try to sign a certificate using the CA we have just set up. Copy your certificate request to the current directory and rename it to newreq.pem (In the next section we will discuss how to generate a certificate request). Then issue the following command.

%./CA.pl -sign

If everything is successful and the request is a valid one, a new certificate called newcert.pem will be created in the same directory.

Self signed certificates using OpenSSL

Use the following command to generate a self-signed x509 certificate (mycert.pem), which is valid for 365 days and an RSA key (mykey.pem) of length 1024.

openssl req -x509 -nodes -days 365 -newkey rsa:1024 \
-keyout mykey.pem -out mycert.pem

Then you have to answer few questions. The information you provide by answering these questions will be stored in the certificate.

Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email Address []:

That's it !!!