Inspect a remote TLS certificate
Build a paste-ready command, then review its compatibility and effects before running it.
openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesComplete required fields to copy the generated command.
Compatibility
Linux + macOSVerified for Linux, macOS using posix, bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementsopensslopenssl must be installed and available on PATH.Network accessThe target must be reachable from the current environment.
Version supportopenssl Current supported releasesVerified for linux, macos using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalssubject=CN = example.comRepresentative successful output; values vary with the selected target and system state.
Known errorsopenssl: command not foundopenssl is missing or is not available on PATH.
Verifyopenssl s_client -connect {{host}}:{{port}} -servername {{host}} </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesThe output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01opensslCommandRuns the openssl stage of this one-liner.
02s_clientArgumentPasses s_client to openssl.
03-connectOptionConfigures openssl with the -connect option.
04<host>:ParameterA value supplied in the Fill parameters section.
05<port>ParameterA value supplied in the Fill parameters section.
06-servernameOptionConfigures openssl with the -servername option.
07<host>ParameterA value supplied in the Fill parameters section.
08<RedirectionRedirects command input, standard output, or error output.
09/dev/nullArgumentPasses /dev/null to openssl.
102>RedirectionRedirects command input, standard output, or error output.
11/dev/nullArgumentPasses /dev/null to openssl.
12|PipelinePasses the output on the left to the command on the right.
13opensslCommandRuns the openssl stage of this one-liner.
14x509ArgumentPasses x509 to openssl.
15-nooutOptionConfigures openssl with the -noout option.
16-subjectOptionConfigures openssl with the -subject option.
17-issuerOptionConfigures openssl with the -issuer option.
18-datesOptionConfigures openssl with the -dates option.
Example input
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Example output
subject=CN = example.com
issuer=C = US, O = Example Trust Services, CN = Example RSA CA
notBefore=Jul 1 00:00:00 2026 GMT
notAfter=Sep 29 23:59:59 2026 GMT
Illustrative output — exact values vary by system and data.
Runbooks
Official sources