Inspect a remote TLS certificate with OpenSSL from PowerShell
Build a paste-ready command, then review its compatibility and effects before running it.
'' | openssl s_client -connect <host>:<port> -servername <host> 2>$null | openssl x509 -noout -subject -issuer -dates -fingerprintComplete required fields to copy the generated command.
Compatibility
PowerShell + OpenSSLRuns in PowerShell 7+ when the OpenSSL executable is installed and available on PATH.
Operational knowledgereview due 2027-01-19
Requirementsshellshell must be installed and available on PATH.Network accessThe target must be reachable from the current environment.
Version supportshell Current supported releasesVerified for windows using powershell syntax; consult compatibility notes for platform-specific differences.
Expected signalssubject=CN=example.comRepresentative successful output; values vary with the selected target and system state.
Known errorsshell: command not foundshell is missing or is not available on PATH.
Verify'' | openssl s_client -connect {{host}}:{{port}} -servername {{host}} 2>$null | openssl x509 -noout -subject -issuer -dates -fingerprintThe output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01''CommandRuns the '' stage of this one-liner.
02|PipelinePasses the output on the left to the command on the right.
03opensslCommandRuns the openssl stage of this one-liner.
04s_clientArgumentPasses s_client to openssl.
05-connectOptionConfigures openssl with the -connect option.
06<host>:ParameterA value supplied in the Fill parameters section.
07<port>ParameterA value supplied in the Fill parameters section.
08-servernameOptionConfigures openssl with the -servername option.
09<host>ParameterA value supplied in the Fill parameters section.
102>RedirectionRedirects command input, standard output, or error output.
11$nullVariableExpands a value from the current shell environment or loop.
12|PipelinePasses the output on the left to the command on the right.
13opensslCommandRuns the openssl stage of this one-liner.
14x509ArgumentPasses x509 to openssl.
15-nooutOptionConfigures openssl with the -noout option.
16-subjectOptionConfigures openssl with the -subject option.
17-issuerOptionConfigures openssl with the -issuer option.
18-datesOptionConfigures openssl with the -dates option.
19-fingerprintOptionConfigures openssl with the -fingerprint option.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
'' | openssl s_client -connect example.com:443 -servername example.com 2>$null | openssl x509 -noout -subject -issuer -dates -fingerprint
Example output
subject=CN=example.com
issuer=C=US, O=Let's Encrypt, CN=E6
notBefore=Jul 21 00:00:00 2026 GMT
notAfter=Oct 19 23:59:59 2026 GMT
SHA1 Fingerprint=4B:9F:2D:0A:7E:3C:1A:0E:7B:6C:29:F5:AD:34:86:2E:9F:17:A3:22
Illustrative output — exact values vary by system and data.
Official sources