validationsecuritysslcryptographypublic-key-encryption

What steps should I take to validate a SSL Certificate manually as browsers do?


How do browsers like Chrome check SSL Certificate?

IS there any online databases or websites that they use?

What steps are taken by browsers to validate a SSL certificate?

Am I able to do it manually without using browser?


Solution

  • How do browsers like Chrome check SSL Certificate?

    The certificate and chain are sent by the server during the SSL handshake. The browser will create the trust chain based on the certificate issuer, provided chain certificates, and the local root certificates. It will check the expiration and purpose of the certificate and also check the subject alternative names (and maybe the subject too) to make sure that the certificate is actually issued for the domain in the URL. It might also do some checks for certificate revocation.

    For details see SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? and How Do Browsers Handle Revoked SSL/TLS Certificates?.

    Is there any online database or websites that they use?

    Not really. The necessary trust store is local. They might check revocation though against some online resource. See Is Certificate validation done completely local?.

    Am I able to do it manually without using a browser?

    Sure, what the browser does could in theory be replicated manually. You can for example access the site and get the leaf and intermediate certificates with openssl s_client -showcerts .... You can then use openssl verify to verify the certificate chain, see also Verify a certificate chain using openssl verify. Then you need to look at the leaf certificate with openssl x509 -text ... to check purpose, expiration and the subject. Revocation is tricky but could be done with the help of openssl crl and openssl ocsp, although this does not really reflect what browsers do.