openssl hangs and does not exit

问题:

I am trying to use openssl to get a certificate, and it seems to keep hanging. I have done a lot of research but not all of the available options seem to work on Windows.

openssl s_client -showcerts -connect google.com:443 > cert.txt

I have tried this:

openssl s_client -connect xyz:443 < quit.txt > cert.txt

Where quit.txt contains "quit\n" from http://bytes.com/topic/php/answers/8802-automate-openssl-s_client-command-batch-php-script

That did not work. I also looked at Openssl s_clinet -connect scripting. Force quit help

I have also tried -prexit

I have also looked into this as well and can't get it working: https://serverfault.com/questions/139728/how-to-download-ssl-certificate-from-a-website

I was doing so well! I managed to do something that I thought would be impossible and a simple thing like this bug managed to stop me for the time being :(

回答1:

It looks like some OpenSSL distributions for Windows are expecting an additional keypress, independant of standard input. Quit.txt gets correctly piped into openssl's STDIN (the server receives QUIT command), but nothing happens until you press any key.

This problem does not exist in Cygwin's version of OpenSSL. Unfortunatly base installation of Cygwin takes about 100 MB of disk space, but you can try to extract only openssl.exe and required libraries.

This method works:

echo QUIT | c:\cygwin\bin\openssl.exe s_client -showcerts -connect google.com:443 > cert.txt

回答2:

On windows, simply typing winpty before your openssl command will do the trick. So, for example, you could create a certificate like so:

winpty openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days XXX

回答3:

If running under mingw64 on windows you can use the winpty program to correctly wrap the terminal

Eg creating alias under bash alias openssl='winpty openssl.exe'

Then openssl s_client -connect blah

Should work as expected

回答4:

For reasons i do not completeley understand, echoing QUIT or quit\n into the input did not work in my case. I'm using MINGW64 with OpenSSL 1.0.2d on Windows 8.1, and i'm using openssl to get certificates from servers inside a bash script. However, just running the openssl command in background and waiting a bit worked for me:

#!/bin/bash

openssl s_client -connect my.server.com:443 -showcerts > output.txt 2>/dev/null &
sleep 2