IT Toolbox
Guide

How to check a TLS certificate with OpenSSL

OpenSSL allows you to quickly control TLS certificate, string and trading from a command line.

TopicCybersecurity →
⌚ About 2 min read
View my favorites
PKI & Certificates. Intermediate. 15 min.

OpenSSL allows you to quickly control TLS certificate, string and trading from a command line.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Test Server.

    Use s_client with SNI.

  2. 2

    Read the certificate

    Read the search,,, dates and SAN.

  3. 3

    Check the string

    Check the intermediaries provided.

  4. 4

    Compare Name.

    The NSS must contain the hostname used.

Commands utiles

opensl s_client -connect instance.com:443 -servername example.com -showcerts.
opensl x509 -in cert.pem -noout - (2002) -issue -dates -ext-t-t-t-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l-l- l- l- l- l-l-l-l-l-i-i-i-i-l-l-l-l-l-l-l- l- l- l- l-

À retenir

  • Always send SNI with -servername.
  • Never copy a private key into a public tool.
← All les guides
Technical deep dive

HTTPS/TLS: separate HTTP availability, TLS handshake and certificate identity

Technical checkpoints

  • An open port 443 does not prove a valid TLS handshake, and a valid handshake does not prove an HTTP 200 response.
  • The certificate must cover the hostname via SAN, be within its validity window and present a complete trust chain.
  • With SNI, testing the IP alone may present a different certificate than the DNS

OpenSSL + HTTP

Test the handshake with the correct servername then read HTTP status separately.

openssl s_client -connect example.com:443 -servername example.com -showcerts
curl -I https://example.com/

Topic-specific pitfalls

  • Do not confuse an expired certificate with a missing intermediate chain: client errors differ.
  • Schannel 36874/36888 should be correlated with protocol/cipher and the client triggering the alert.

How to validate

  • Hostname, chain, dates and protocol are valid from a representative client.
  • The HTTP request reaches the expected backend and returns the intended status.
♡ 0