IT Toolbox
Guide

How to check the string of an HTTPS certificate with OpenSSL

s_client allows to see the certificate actually presented by a server and the intermediate certificates sent to the client.

TopicCybersecurity →
⌚ About 2 min read
View my favorites
SSL/PKI Intermediate. 10 min

s_client allows to see the certificate actually presented by a server and the intermediate certificates sent to the client.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Test with SNI.

    Use the same DNS name for -connect and -servername when the site is being commuted.

  2. 2

    Read dates.

    Check notorate and notaty.

  3. 3

    Control the NDS.

    Make sure the name used by the client is covered.

  4. 4

    Examine the chain.

    Check that the necessary intermediaries are presented.

  5. 5

    Compare from several networks.

    If a proxy TLS is present, the certificate may differ.

Commands utiles

opensl s_client -connect example.fr:443 -servername example.fr -showcerts
opensl x509 -nout - (2002) -issue -dates -ext-t-subAlt-(1)

À retenir

  • The certificate stored on the server is not necessarily the one presented to the client.
  • A root usually does not need to be sent by the server.
  • A host name error does not correct by ignoring TLS validation.
← All les guides
Technical deep dive

HTTPS/TLS: separate HTTP availability, TLS handshake and certificate identity

Technical checkpoints

  • An open port 443 does not prove a valid TLS handshake, and a valid handshake does not prove an HTTP 200 response.
  • The certificate must cover the hostname via SAN, be within its validity window and present a complete trust chain.
  • With SNI

OpenSSL + HTTP

Test the handshake with the correct servername then read HTTP status separately.

openssl s_client -connect example.com:443 -servername example.com -showcerts
curl -I https://example.com/

Topic-specific pitfalls

  • Do not confuse an expired certificate with a missing intermediate chain: client errors differ.
  • Schannel 36874/36888 should be correlated with protocol/cipher and the client triggering the alert.

How to validate

  • Hostname, chain, dates and protocol are valid from a representative client.
  • The HTTP request reaches the expected backend and returns the intended status.
♡ 0