Toolbox · Networking
TLS Debugging
Inspect certificates, chains, protocols and ciphers; diagnose handshake failures and expiry.
On this page
Inspect a live endpoint
| Command | Purpose |
|---|---|
openssl s_client -connect host:443 -servername host < /dev/null | Handshake with SNI, print chain |
openssl s_client -connect host:443 -servername host < /dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer | Validity and issuer |
openssl s_client -connect host:443 -servername host -tls1_2 < /dev/null | Force a protocol version |
openssl s_client -connect host:443 -servername host -showcerts < /dev/null | Full chain PEM |
curl -vI https://host/ 2>&1 | grep -iE 'SSL connection|subject|issuer|expire' | Quick summary via curl |
nmap --script ssl-enum-ciphers -p 443 host | Supported protocols/ciphers |
Inspect certificate files
| Command | Purpose |
|---|---|
openssl x509 -in cert.pem -noout -text | Everything |
openssl x509 -in cert.pem -noout -enddate | Expiry |
openssl x509 -in cert.pem -noout -ext subjectAltName | SANs |
openssl verify -CAfile chain.pem cert.pem | Chain validation |
openssl x509 -noout -modulus -in cert.pem | sha256sum; openssl rsa -noout -modulus -in key.pem | sha256sum | Key matches cert |
openssl pkcs12 -in bundle.p12 -info -noout | Inspect PKCS#12 |
Kubernetes and cert-manager
| Command | Purpose |
|---|---|
kubectl get secret tls-web -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -dates | Expiry of a TLS secret |
kubectl get certificate,certificaterequest,order,challenge -A | cert-manager pipeline |
kubectl describe certificate web-tls | Issuance errors |
Common failures
| Error | Meaning | Check |
|---|---|---|
unable to get local issuer certificate | Missing intermediate or untrusted CA | Serve the full chain; check -showcerts |
certificate has expired | Expired leaf or intermediate | -dates; renew; check clock skew with date -u |
handshake failure | No shared protocol/cipher | -tls1_2, ssl-enum-ciphers |
hostname mismatch | SAN does not include the host | -ext subjectAltName |
| Cloudflare 525/526 | Origin handshake failed / invalid origin cert | Origin must present a valid cert for Full (strict) |
See also
- Cloud Network Security Boundaries: proving a minimum-TLS setting from outside with
s_client -tls1_1 -cipher 'DEFAULT:@SECLEVEL=0'.