Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • Can you explain, what exactly this loop does? Am I right, that this will only work as long openssl will not read the input as a whole, but line by line until it is able to read one certificate, so that it reads one certificate at each iteration? Commented Mar 22, 2022 at 7:08
  • 2
    @stackprotector I'm stating openssl always read the minimal information. This property allows to chain multiple times openssl when receiving more than one cert. Other example: openssl s_client -connect unix.stackexchange.com:443 -showcerts </dev/null | while openssl x509 -noout -subject 2>/dev/null; do : ; done to display only cert names from unix.stackexchange.com (server's + 1 intermediate). This property can also be used with other use cases to build dynamic configuration for CSR: openssl req ... -config <(some commands) (using bash). But I don't know if it's explicitly documented. Commented Mar 22, 2022 at 13:22
  • 1
    This type of code is hard to read, hard to extend. Could it be changed so that there's no code executed inside of the while loop condition? (For example, so I could do something with the output other than print it to the console). Commented Nov 2, 2022 at 9:22
  • 1
    Let me give an example. Say I want to see only the first 10 lines of the openssl output (for each cert). I can't pipe the output to 'head' or try to put it in a variable, that makes the code cause errors. It's given as-is, I don't understand how it works. Not the openssl part, the BASH part. Bash syntax is notoriously nasty. I've just spent the last 4 hours trying to do this simple thing, gave up and wrote a program instead. Commented Nov 2, 2022 at 13:26
  • 1
    @aphid "Could it be changed so that there's no code executed inside of the while loop condition?" Not easily, no — the loop condition is "when openssl fails" (due to running out of certificates), which can't be tested without running openssl. Piping the openssl output into things breaks this because you lose the exit status — but you can turn that behaviour of bash off with the pipefail option, like so: ( set -o pipefail ; while openssl x509 -noout -text | head ; do :; done ) < cert-bundle.pem Commented Jul 4 at 0:52