Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I run my own mail servers and have them set up to support SSL connections over IMAP/SMTP. They are GoDaddy SSL certificates and are recognized by Mail and IOS since the root authority (godaddy) is trusted.

However, I suspected that I am coming up on my expiration for the SSL certificate on one of my mail servers, so I want to look at the certificate's expiry date - I can't find where to do this in Mail and I can't find a certificate for my server in key chain. I suspect it's not there since there is nothing to add - the root certificate (godaddy) is there, so there is no reason to add my child certificate.

How do I look at SSL certificate attributes in OS X? Where can I find my certificate? In Thunderbird you just click on server > security and hit certificates.

share|improve this question
    
I found a shell script that checks SSL certs, but I was looking for a non-3rd-party way to do this... prefetch.net/code/ssl-cert-check –  skub Aug 13 '11 at 16:39
    
While I liked both answers, I preferred bmike's since this info is going it to a tutorial for non-tech users and using the command line is generally thought of as 'not user friendly'. At least by management... –  skub Aug 14 '11 at 1:48

2 Answers 2

up vote 1 down vote accepted

I'm not aware of any way to force Mail to enter the error dialog, so you'll have to get the certificate from the mail server using another tool. (mail is getting it each time it works, just not dumping it to a file or an assistant for you to peek at)

Lion uses the Keychain Access app (from /Applications/Utilities/ ) to manage certificates and view validation chains, root certificates, check validity, etc... The command line equivalent that does the work behind the pretty GUI is security.

There is some basic documentation covering evaluating ssl certificates but they assume you already understand the mechanics of Public Key Cryptography.

Here is what the Certificate Assistant looks like when evaluating Apple's Code Signing Certificate that shipped with Lion.

enter image description here enter image description here

share|improve this answer
    
I've done this and I've even specified the port (993/465) and it responds "No certificates were returned from the host." The keychain doesn't contain the certificate from my mail server for some reason. I have 4 email accounts with SSL enabled, so I know it's using SSL. –  skub Aug 13 '11 at 18:54
    
That's probably the idea. I couldn't figure out how to get that dialog in Mail for a vaild certificate. That's the answer. –  skub Aug 13 '11 at 19:04
    
Your keychain is not supposed to contain the certs for the remote host - just the root certificate for the CA that signed those certs. The exception would be for self-signed certs that you manually added yourself. –  zzz Aug 13 '11 at 19:13
    
I did, but it doesn't seem to be working for my mail server - so I guess I'll have to troubleshoot that. It does work for the mail.me.com server. –  skub Aug 13 '11 at 19:15
    
If you need more debug - just type the openssl s_client -connect host:port and see what it's spitting. If your server isn't talking on that port, that would make it hard to get a cert :-) –  bmike Aug 13 '11 at 19:16

This is not in Mail, I know of no way to do that, but this does not require any new software. In Terminal:

echo ^d|openssl s_client -connect host:port 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -noout -subject -dates

share|improve this answer
    
This looks like a great way to get the certificate as well - Great answer Alrescha! –  bmike Aug 13 '11 at 19:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.