download cert with curl, echo cert value into openssl

Question

I'm trying to get an intermediate certificate using curl, and process the certificate without writing it to a file.

I've figured out how to process a leaf cert and get the distribution point, but that's where I'm stuck.

For an example, let's take stackoverflow (seems pertinent). The first intermediate cert for SO is from http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt.

In an interactive shell, I can do something like this to store the value of the certificate into a variable:

DigiCertIntermediateCert=$(curl http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt)

Then I can check the value of the cert by doing something like this:

echo "$DigiCertIntermediateCert" | openssl x509 -inform DER -outform PEM

This outputs the nice and friendly PEM-formed cert. It looks like this:

-----BEGIN CERTIFICATE-----
MIIEsTCCA5mgAwIBAgIQBOHnpNxc8vNtwCtCuF0VnzANBgkqhkiG9w0BAQsFADBs
...
cPUeybQ=
-----END CERTIFICATE-----

(Note: this will change when the intermediate cert changes, if this isn't exactly the value you're seeing, don't freak out)

Neat! Seems like this should work. Let's throw all this logic into a script with some basic case handling (like if the cert is in a different form, then we should interpret it as that form) and we should be done, right?

#! /bin/bash

cert_content=$(curl -s "$1")
echo "$cert_content"

if echo "$cert_content" | openssl x509 -text -noout; then
    echo "Not converting"
    echo "$cert_content"
else
    echo "Converting"
    echo "$cert_content" | openssl x509 -inform DER -outform PEM
fi

What does this output when we feed the url?

...
[binary contents of a certificate]
...
unable to load certificate
4667577964:error:09FFF06C:PEM routines:CRYPTO_internal:no start line:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.230.1/libressl-2.6/crypto/pem/pem_lib.c:683:Expecting: TRUSTED CERTIFICATE
Converting
unable to load certificate
4421875308:error:0DFFF08E:asn1 encoding routines:CRYPTO_internal:not enough data:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.230.1/libressl-2.6/crypto/asn1/a_d2i_fp.c:251:

So it's pretty easy to see that the certificate is in DER form (because of the "Converting" line), but it looks like the certificate is not complete - note the error:

unable to load certificate
4421875308:error:0DFFF08E:asn1 encoding routines:CRYPTO_internal:not enough data:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.230.1/libressl-2.6/crypto/asn1/a_d2i_fp.c:251:

says that there is not enough data.

Why is this different between the script and the actions I'm taking in the shell? How can I feed the binary cert through the openssl tool to get the PEM-form cert out?

Answer 1

As the question alludes, I was not strict enough in my shell usage. The "interactive" session was done using zsh, and the script was run under bash. zsh will append an EOF to variables passed through its pipes, while bash (apparently) does not. Now my quest becomes how to append an EOF to a variable in bash (which, apparently, is non-trivial).