Certificate chain extraction script

extract-cert-chain.sh

#!/bin/bash

# Accept stdin as input domain and dump the certificate chain
domain="$1"
openssl s_client -connect "$domain:443" -showcerts </dev/null 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > fullchain.pem

# Split the chain into individual certificates
awk '/BEGIN CERTIFICATE/{n++} {print >("cert-" n ".pem")}' fullchain.pem

# Rename the split files for clarity, handling 2 or 3 certificates
if [ -f cert-1.pem ]; then mv cert-1.pem server.crt; fi
if [ -f cert-2.pem ]; then
  if [ ! -f cert-3.pem ]; then
    mv cert-2.pem root.crt
  else
    mv cert-2.pem intermediate.crt
  fi
fi
if [ -f cert-3.pem ]; then mv cert-3.pem root.crt; fi

# 3 certs - google.com
# 2 certs - facebook.com