Test specific TLS protocol

Force a version to confirm support; use -tls1_3 / -no_tls1_2 to test policy

openssl s_client -connect <host>:443 -tls1_2 </dev/null 2>&1 | grep -E 'Protocol|Cipher'
tool
openssl27 commands
tags
openssltlssecuritytroubleshooting

More openssl commands

  • Generate RSA private key
    openssl genrsa -out private.key 4096

    Generate a 4096-bit RSA private key

  • Generate Ed25519 key pair
    openssl genpkey -algorithm ed25519 -out private.key && openssl pkey -in private.key -pubout -out public.key

    Modern Ed25519 key (smaller, faster than RSA)

  • Create CSR
    openssl req -new -key private.key -out request.csr -subj '/CN=example.com/O=MyOrg/C=RU'

    Certificate Signing Request for CA submission

  • Self-signed certificate
    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj '/CN=localhost'

    Generate self-signed cert + key in one command

  • View certificate details
    openssl x509 -in cert.pem -noout -text | grep -E 'Subject:|Issuer:|Not (Before|After)|DNS:'

    Show subject, issuer, validity dates, SANs

all 27 openssl commands