Connect to a server and show certificate:
openssl s_client -connect example.com:443
With SNI (Server Name Indication):
openssl s_client -connect example.com:443 -servername example.com
Show full certificate chain:
openssl s_client -connect example.com:443 -showcerts
Test mutual TLS connection by presenting client certificate and private key:
openssl s_client -connect server.example.com:443 \
-cert your_certificate.crt \
-key your_private.key
If the server rejects your certificate, you may see these errors:
| Error Message | Meaning |
|---|---|
tlsv1 alert unknown | Server rejected the certificate |
ssl/tls alert certificate unknown | Certificate not recognized |
SSL3 alert read:fatal:certificate unknown | Fatal certificate error |
SSL alert number 46 | Certificate unknown alert |
unexpected eof while reading | Connection closed unexpectedly |
.crt file is valid by comparing the MD5 checksum with your key file.# Verify certificate and key match
openssl x509 -noout -modulus -in your_certificate.crt | openssl md5
openssl rsa -noout -modulus -in your_private.key | openssl md5
Download and save server certificate:
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -out cert.pem
Verify against system CA bundle:
openssl verify cert.pem
Verify against specific CA:
openssl verify -CAfile ca.pem cert.pem
Verify certificate chain:
openssl verify -CAfile ca.pem -untrusted intermediate.pem cert.pem
Check if certificate is valid for a domain:
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
openssl x509 -noout -subject -dates
TLS 1.2:
openssl s_client -connect example.com:443 -tls1_2
TLS 1.3:
openssl s_client -connect example.com:443 -tls1_3
openssl s_client -connect example.com:443 -cipher 'ALL' 2>/dev/null | \
grep "Cipher is"
List available ciphers:
openssl ciphers -v
Verify file signature with public key:
openssl dgst -sha256 -verify public.key -signature file.sig file.txt
Create signature:
openssl dgst -sha256 -sign private.key -out file.sig file.txt
Check certificate revocation status:
openssl ocsp -issuer issuer.pem -cert cert.pem -url http://ocsp.example.com -resp_text