OpenSSL 3 cheatsheet
OpenSSL 3: Inspecting TLS servers
5 common OpenSSL 3 tasks.
Inspect a server's certificate
Connect to a server and print its certificate chain. -servername sets SNI, which many hosts need.
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null
Check a site's certificate expiry
Print the dates of the certificate a server presents.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
Test a TLS version
Check whether a server accepts TLS 1.3.
openssl s_client -connect example.com:443 -tls1_3 </dev/null
Test STARTTLS on a mail server
Connect over SMTP and upgrade to TLS.
openssl s_client -connect smtp.example.com:587 -starttls smtp
Run a quick TLS test server
Serve a certificate on a port to test clients.
openssl s_server -accept 4433 -cert cert.pem -key key.pem -www