Inspect a TLS Certificate with OpenSSL

Photo: Unsplash.

When a browser reports a certificate problem, inspect the certificate served over the network—not only the file you expected Nginx to load.

Connect with Server Name Indication (SNI) and print the leaf certificate:

openssl s_client \
  -connect example.com:443 \
  -servername example.com \
  -showcerts </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -serial -dates

Without -servername, a multi-site server may return its default certificate and send you in the wrong direction.

Check the names covered by the certificate:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -ext subjectAltName

To see the SHA-256 fingerprint:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -fingerprint -sha256

To check whether it expires within 30 days, use seconds:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -checkend 2592000

Exit status 0 means the certificate remains valid beyond that interval. This checks time, not hostname or trust.

For chain diagnosis, keep the unfiltered s_client -showcerts output and read Verify return code at the end. A correct leaf file with a missing intermediate can still fail for clients. Compare the remotely served serial or fingerprint after every deployment so you know the reload actually took effect.

References

• OpenSSL: s_client
• OpenSSL: x509