Here is how you can check certificate validity and troubleshoot TLS connection issues using OpenSSL client command-line utility:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 |
# openssl s_client -showcerts -connect domain.com:443 CONNECTED(00000003) depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R10 verify return:1 depth=0 CN = domain.com verify return:1 --- Certificate chain 0 s:/CN=domain.com i:/C=US/O=Let's Encrypt/CN=R10 -----BEGIN CERTIFICATE----- MIIF7jCCBNagAwIBAgISA1XdpETwO0ian7y2qVNABOhuMA0GCSqGSIb3DQEBCwUA MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD EwNSMTAwHhcNMjQxMjE3MTMyODU0WhcNMjUwMzE3MTMyODUzWjAZMRcwFQYDVQQD Ew5wYnguZ29jYWxsLmFwcDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB ANUffjLn8J0WEQk+/g01WumVI6z2JMKUUKoSeETBgQR3kwFLbQgoHPSJ7xY1GiLK 5OnY2FgW0YKmuW0SS0d4onYFliXwuq/jHralo2N7ggVFDrRGnoAEevtlOp79f81y jp1+b7pHT2tdnrLGA5ZbpIIJR4Bj5eleZzp2k9Ss1kA1wXfJg49kxM/IRAMyMiiQ /Yq/3TmxHSNJ6zpaGCGQJvXMS2jMI44or80Km0i/l5BCYIA6S+BWpoTzhHXfyvAw KwYz6weL6U4V+RY7P+a5XfGwjiFMb7gm6tqH+wfqysIInNfBG+bVF+wUvaqZmJYV bB/tcs+zRPlMfeyDYVjYeysdO6sfVCof6saLsYPdn8BH1xbw7BO93q9z/gkkGtCW BL4CZkm3QCvVa9IjL/og8kNdzpFrRrkbfslPjWk7mzkVQfBimzNMWOgv1e/jmZXK Ph7JfMRllcMJ5IUtXNyctIR9R5C96aD2k1qyL0DiKSjbMcKiN4posn6WuCFREq22 Xah/n7g3xrA32xJEqvlVuyU/F2MntOLmQWWs8Z4XFDNTnsrT+/hWZI5UuYoeMgNU jKt4O2DCI4zQhxfiVdjiGrcsOSrokudXfshnxKnGYCcP6PrBT0NtobM1psUMf4GR NtU8sdYuAXe7Pij9+hg0OGoT7GVx6eCo/z+Wt065CEG1AgMBAAGjggIUMIICEDAO BgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwG A1UdEwEB/wQCMAAwHQYDVR0OBBYEFBGzX3kvPPqvYlQCBB2D0H906ODtMB8GA1Ud IwQYMBaAFLu8w0el5LypxsOkcgwQjaI14cjoMFcGCCsGAQUFBwEBBEswSTAiBggr BgEFBQcwAYYWaHR0cDovL3IxMC5vLmxlbmNyLm9yZzAjBggrBgEFBQcwAoYXaHR0 cDovL3IxMC5pLmxlbmNyLm9yZy8wGQYDVR0RBBIwEIIOcGJ4LmdvY2FsbC5hcHAw EwYDVR0gBAwwCjAIBgZngQwBAgEwggEGBgorBgEEAdZ5AgQCBIH3BIH0APIAdwCi 4wrkRe+9rZt+OO1HZ3dT14JbhJTXK14bLMS5UKRH5wAAAZPVBDxeAAAEAwBIMEYC IQDcdP/962yVxS8cjY+S7d1QCcQQGk35xYft+Spa7Igl2AIhAIWzLNVKRgKb/Gcv mEa2tIdil4nR7CVQGutXZzZnqtThAHcAzxFW7tUufK/zh1vZaS6b6RpxZ0qwF+ys AdJbd87MOwgAAAGT1QQ8kwAABAMASDBGAiEA1m5xBk2kwrh29yQA6ihRhFc0Vmow s3EY9bL+xdRcbOECIQConlKg04LC7pqFuN8H+CbBLMrBF5kt7VOj7Ln/yV6nHDAN BgkqhkiG9w0BAQsFAAOCAQEAGAan+4RpRCCADEWmvuyZGdprhJThkWlx3SX+Ze1D dvwrP61Gcd/N8YzM//uHl6rXVFOJZ53xH95ReUbY8ChpHvWYsBXPfzmT48Xu3P8P bhf7nJDCuIy2HXEh/7HaWCxsJc/gveLS8j7WB+zCaFbQRIN/zz2PONAW0BYyumuS UF2OJad/Ro+EtpsL3zCYhczpkpNJ9Swqlt+1oPJMluANCt1OZIjoAqrBS9/IXvGE sveXwZphW57OqAm8fUh9KKpPFYXdagIGDb/lmUAMvpH8IQi6+LuaqFgpU4HpkOOs AgwFlMmnq2xLM1N+CMXamVAhqcOQprog== -----END CERTIFICATE----- 1 s:/C=US/O=Let's Encrypt/CN=R10 i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1 -----BEGIN CERTIFICATE----- MIIFBTCCAu2gAwIBAgIQS6hSk/eaL6JzBkuoBI110DANBgkqhkiG9w0BAQsFADBP MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF bmNyeXB0MQwwCgYDVQQDEwNSMTAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQDPV+XmxFQS7bRH/sknWHZGUCiMHT6I3wWd1bUYKb3dtVq/+vbOo76vACFL YlpaPAEvxVgD9on/jhFD68G14BQHlo9vH9fnuoE5CXVlt8KvGFs3Jijno/QHK20a /6tYvJWuQP/py1fEtVt/eA0YYbwX51TGu0mRzW4Y0YCF7qZlNrx06rxQTOr8IfM4 FpOUurDTazgGzRYSespSdcitdrLCnF2YRVxvYXvGLe48E1KGAdlX5jgc3421H5KR mudKHMxFqHJV8LDmowfs/acbZp4/SItxhHFYyTr6717yW0QrPHTnj7JHwQdqzZq3 DZb3EoEmUVQK7GH29/Xi8orIlQ2NAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/ AgEAMB0GA1UdDgQWBBS7vMNHpeS8qcbDpHIMEI2iNeHI6DAfBgNVHSMEGDAWgBR5 tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B AQsFAAOCAgEAkrHnQTfreZ2B5s3iJeE6IOmQRJWjgVzPw139vaBw1bGWKCIL0vIo zwzn1OZDjCQiHcFCktEJr59L9MhwTyAWsVrdAfYf+B9haxQnsHKNY67u4s5Lzzfd u6PUzeetUK29v+PsPmI2cJkxp+iN3epi4hKu9ZzUPSwMqtCceb7qPVxEbpYxY1p9 1n5PJKBLBX9eb9LU6l8zSxPWV7bK3lG4XaMJgnT9x3ies7msFtpKK5bDtotij/l0 GaKeA97pb5uwD9KgWvaFXMIEt8jVTjLEvwRdvCn294GPDF08U8lAkIv7tghluaQh 1QnlE4SEN4LOECj8dsIGJXpGUk3aU3KkJz9icKy+aUgA+2cP21uh6NcDIS3XyfaZ QjmDQ993ChII8SXWupQZVBiIpcWO4RqZk3lr7Bz5MUCwzDIA359e57SSq5CCkY0N 4B6Vulk7LktfwrdGNVI5BsC9qqxSwSKgRJeZ9wygIaehbHFHFhcBaMDKpiZlBHyz rsnnlFXCb5s8HKn5LsUgGvB24L7sGNZP2CX7dhHov+YhD+jozLW2p9W4959Bz2Ei RmqDtmiXLnzqTpXbI+suyCsohKRg6Un0RC47+cpiVwHiXZAW+cn8eiNIjqbVgXLx KPpdzvvtTnOPlCunr3Bf9b77AiC/36dRILKz7OA54= -----END CERTIFICATE----- --- Server certificate subject=/CN=domain.com issuer=/C=US/O=Let's Encrypt/CN=R10 --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 3761 bytes and written 415 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES128-GCM-SHA256 Session-ID: 127C68CB0675B782FB511098EE0D63E17D0F3B66FB2C93471BD8097A266F4CC8 Session-ID-ctx: Master-Key: B433A5B2E0B018C56A5DFE9983DDD4D7C7D5CAC6F4319492DBB11662522FB0B4A2F17A564F8D63F4D43343F91B5E61F0 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 3f 77 72 a9 d1 18 10 06-c7 f0 cc 7e a3 f4 99 9f ?wr........~.... 0010 - 32 d1 cd 92 36 eb c5 79-01 7b c0 19 2d 36 77 b9 2...6..y.{..-6w. 0020 - a2 b8 da e6 53 20 20 01-dc 8b 25 10 86 53 cf 71 ....S ...%..S.q 0030 - 36 27 dd 92 d6 ce a5 43-eb f9 f5 3e 06 13 26 f7 6'.....C...>..&. 0040 - c3 76 cd 96 cf c9 f3 24-f6 ac 95 71 13 95 90 5e .v.....$...q...^ 0050 - a3 c9 aa 7f 4d 41 e1 2b-21 3a 32 6c f4 e4 54 66 ....MA.+!:2l..Tf 0060 - 93 0f e9 b8 08 74 6c 07-11 07 93 da 56 ea c9 46 .....tl.....V..F 0070 - 86 d6 13 e7 d3 20 c1 8d-dd b7 c2 fe 14 1d 46 6a ..... ........Fj 0080 - ed a1 1f 16 bf 8b f2 98-7e 82 fb c9 cd 1c 04 4b ........~......K 0090 - 55 88 79 4d f8 58 72 8b-76 ec 2b 07 74 fc 60 02 U.yM.Xr.v.+.t.`. 00a0 - 2a f1 b7 59 99 3b b3 bd-b2 a1 9d e0 4b 85 74 a8 *..Y.;......K.t. 00b0 - 43 e4 99 64 67 c5 bd 42-d1 21 4a fa 18 1a d3 71 C..dg..B.!J....q Start Time: 1739976742 Timeout : 300 (sec) Verify return code: 0 (ok) --- read:errno=0 |
Good luck!