Print subjects, issuers, and validity dates for a TLS chain
Build a paste-ready command, then review its compatibility and effects before running it.
openssl s_client -showcerts -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl crl2pkcs7 -nocrl -certfile /dev/stdin | openssl pkcs7 -print_certs -nooutComplete required fields to copy the generated command.
Compatibility
LinuxVerified for Linux using bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementsopensslopenssl must be installed and available on PATH.Network accessThe target must be reachable from the current environment.
Version supportopenssl Current supported releasesVerified for linux using bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalssubject=CN = example.comRepresentative successful output; values vary with the selected target and system state.
Known errorsopenssl: command not foundopenssl is missing or is not available on PATH.
Verifyopenssl s_client -showcerts -connect {{host}}:{{port}} -servername {{host}} </dev/null 2>/dev/null | openssl crl2pkcs7 -nocrl -certfile /dev/stdin | openssl pkcs7 -print_certs -nooutThe output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01opensslCommandRuns the openssl stage of this one-liner.
02s_clientArgumentPasses s_client to openssl.
03-showcertsOptionConfigures openssl with the -showcerts option.
04-connectOptionConfigures openssl with the -connect option.
05<host>:ParameterA value supplied in the Fill parameters section.
06<port>ParameterA value supplied in the Fill parameters section.
07-servernameOptionConfigures openssl with the -servername option.
08<host>ParameterA value supplied in the Fill parameters section.
09<RedirectionRedirects command input, standard output, or error output.
10/dev/nullArgumentPasses /dev/null to openssl.
112>RedirectionRedirects command input, standard output, or error output.
12/dev/nullArgumentPasses /dev/null to openssl.
13|PipelinePasses the output on the left to the command on the right.
14opensslCommandRuns the openssl stage of this one-liner.
15crl2pkcs7ArgumentPasses crl2pkcs7 to openssl.
16-nocrlOptionConfigures openssl with the -nocrl option.
17-certfileOptionConfigures openssl with the -certfile option.
18/dev/stdinArgumentPasses /dev/stdin to openssl.
19|PipelinePasses the output on the left to the command on the right.
20opensslCommandRuns the openssl stage of this one-liner.
21pkcs7ArgumentPasses pkcs7 to openssl.
22-print_certsOptionConfigures openssl with the -print_certs option.
23-nooutOptionConfigures openssl with the -noout option.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
openssl s_client -showcerts -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl crl2pkcs7 -nocrl -certfile /dev/stdin | openssl pkcs7 -print_certs -noout
Example output
subject=CN = example.com
issuer=C = US, O = Let's Encrypt, CN = E6
subject=C = US, O = Let's Encrypt, CN = E6
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1
Illustrative output — exact values vary by system and data.
Official sources