openssl s_client
Networking
Usage
openssl s_client -connect <host>:443 -servername <host>Opens a raw TLS connection so you can inspect the certificate and the handshake; leave out `-servername` and a server hosting many sites on one address hands you its default certificate, and without `< /dev/null` it sits there waiting for input.
Common flags
| Flag | Meaning |
|---|---|
| -connect host:443 | Where to open the TLS connection. |
| -servername <host> | The SNI name. Without it a shared host serves its default certificate. |
| -showcerts | Print the whole chain the server sent, not just the leaf. |
| -tls1_2 / -tls1_3 | Force one protocol version, to test what the server still accepts. |
| -verify_return_error | Fail instead of continuing when the chain does not validate. |
| < /dev/null | Close stdin, or the command sits and waits forever. |
Examples
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -datesWhen the certificate expires.
openssl s_client -connect example.com:443 -showcerts < /dev/nullInspect the full chain for a missing intermediate.
When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does openssl s_client do?
Opens a raw TLS connection so you can inspect the certificate and the handshake; leave out `-servername` and a server hosting many sites on one address hands you its default certificate, and without `< /dev/null` it sits there waiting for input.
Q. How do I type it?
openssl s_client -connect <host>:443 -servername <host> — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
6 are listed here; the full set is in man openssl. This command sits under Networking.
Related commands
man page: man openssl-s_client