Inspect live server chain

Fetch full chain with SNI; -servername is mandatory for vhosts/SNI backends

openssl s_client -connect <host>:443 -servername <host> -showcerts </dev/null 2>/dev/null
tool
openssl27 commands
tags
openssltlsnetworkdebug

More openssl commands

  • Extract SAN list
    openssl x509 -in cert.pem -noout -ext subjectAltName

    Show only SAN entries; modern browsers ignore CN, so SAN is what matters

  • Verify cert against CA chain
    openssl verify -CAfile ca-chain.pem cert.pem

    Validate trust chain; note: -CAfile must hold intermediates+root in order

  • Match cert and private key
    diff <(openssl x509 -in cert.pem -noout -modulus | md5sum) <(openssl rsa -in key.pem -noout -modulus | md5sum)

    Equal modulus hashes prove key matches cert; empty diff = match

  • CSR + key in one shot
    openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.csr -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"

    Generate key+CSR with SAN inline; -addext avoids editing openssl.cnf

  • Self-signed cert with SAN
    openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"

    One-liner self-signed cert valid 1y; SAN required or TLS clients reject it

all 27 openssl commands