5

I run my own mail servers and have them set up to support SSL connections over IMAP/SMTP. They are GoDaddy SSL certificates and are recognized by Mail and IOS since the root authority (godaddy) is trusted.

However, I suspected that I am coming up on my expiration for the SSL certificate on one of my mail servers, so I want to look at the certificate's expiry date - I can't find where to do this in Mail and I can't find a certificate for my server in key chain. I suspect it's not there since there is nothing to add - the root certificate (godaddy) is there, so there is no reason to add my child certificate.

How do I look at SSL certificate attributes in OS X? Where can I find my certificate? In Thunderbird you just click on server > security and hit certificates.

Improve this question
2
  • I found a shell script that checks SSL certs, but I was looking for a non-3rd-party way to do this... prefetch.net/code/ssl-cert-check
    – skub
    Aug 13, 2011 at 16:39
  • While I liked both answers, I preferred bmike's since this info is going it to a tutorial for non-tech users and using the command line is generally thought of as 'not user friendly'. At least by management...
    – skub
    Aug 14, 2011 at 1:48

2 Answers 2

Reset to default
1

I'm not aware of any way to force Mail to enter the error dialog, so you'll have to get the certificate from the mail server using another tool. (mail is getting it each time it works, just not dumping it to a file or an assistant for you to peek at)

Lion uses the Keychain Access app (from /Applications/Utilities/ ) to manage certificates and view validation chains, root certificates, check validity, etc... The command line equivalent that does the work behind the pretty GUI is security.

There is some basic documentation covering evaluating ssl certificates but they assume you already understand the mechanics of Public Key Cryptography.

Here is what the Certificate Assistant looks like when evaluating Apple's Code Signing Certificate that shipped with Lion.

enter image description here enter image description here

Improve this answer
6
  • I've done this and I've even specified the port (993/465) and it responds "No certificates were returned from the host." The keychain doesn't contain the certificate from my mail server for some reason. I have 4 email accounts with SSL enabled, so I know it's using SSL.
    – skub
    Aug 13, 2011 at 18:54
  • That's probably the idea. I couldn't figure out how to get that dialog in Mail for a vaild certificate. That's the answer.
    – skub
    Aug 13, 2011 at 19:04
  • Your keychain is not supposed to contain the certs for the remote host - just the root certificate for the CA that signed those certs. The exception would be for self-signed certs that you manually added yourself.
    – zzz
    Aug 13, 2011 at 19:13
  • I did, but it doesn't seem to be working for my mail server - so I guess I'll have to troubleshoot that. It does work for the mail.me.com server.
    – skub
    Aug 13, 2011 at 19:15
  • If you need more debug - just type the openssl s_client -connect host:port and see what it's spitting. If your server isn't talking on that port, that would make it hard to get a cert :-)
    – bmike ♦
    Aug 13, 2011 at 19:16
5

This is not in Mail, I know of no way to do that, but this does not require any new software. In Terminal:

echo ^d|openssl s_client -connect host:port 2>/dev/null |  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' |  openssl x509 -noout -subject -dates
Improve this answer
3
  • This looks like a great way to get the certificate as well - Great answer Alrescha!
    – bmike ♦
    Aug 13, 2011 at 19:05
  • This is a great answer that works well!
    – Tim Dearborn
    May 5, 2015 at 15:02
  • I'm looking to do this for certs I use for iOS provisioning and APNS, but if I download the certs from the Apple Dev site, it's a .cer and the openssl command above returns pem_lib.c:696:Expecting: TRUSTED CERTIFICATE.
    – Alex Zavatone
    May 16, 2017 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .