openssl — certificate and TLS verification

💬 "openssl command"

openssl directly checks certificate information and TLS connections. It is essential for diagnosing expiration and chain issues.

You can inspect both local certificate files and remote server TLS handshakes.

• Concept: Handles certificates/keys and inspects TLS connections.
• x509: Prints certificate details and expiration dates.
• s_client: Directly checks remote TLS connections.
• Items to check: subject, SAN, validity period, chain, and protocol.

Commonly used options

3 essential command combinations

• openssl x509 -in /etc/nginx/ssl/site.crt -noout -dates — Check local certificate expiration date
• echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates — Check remote certificate expiration date
• openssl x509 -in site.crt -noout -subject -issuer -ext subjectAltName — Check subject, issuer, and SAN

💬 "Tell me one way to reduce trial and error with this"

Here are common situations on production servers, organized in order.

Step 1 · Check local certificate

Check the expiration date of the certificate installed on the server.

openssl x509 -in /etc/nginx/ssl/site.crt -noout -dates

Step 2 · Remote check

Check the certificate that is actually being served.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -dates

Step 3 · Expiration management

If expiration is imminent, proceed with renewal.

openssl x509 -in /etc/nginx/ssl/site.crt -noout -checkend 2592000

This is how it is used in practice

1. Responding to certificate expiration warnings

Situation — Monitoring alerted that the certificate expires in 30 days.

openssl x509 -in /etc/nginx/ssl/site.crt -noout -checkend 2592000

Result — If it expires within 30 days, a warning message is printed.

Point — Also check whether automatic renewal (certbot timer) is working before expiration.

2. Checking certificates by domain

Situation — Multiple domains use one IP, but only one specific domain has a certificate error.

echo | openssl s_client -connect 203.0.113.24:443 -servername shop.example.com 2>/dev/null | openssl x509 -noout -subject

Result — Check whether the certificate for the domain requested via SNI is returned.

Point — If SNI is not specified, the default certificate may be returned and cause confusion.

Things to watch out for

• s_client is for diagnostics. It may differ from actual browser validation (chain and SAN).
• Manage permissions so private key files are not exposed.
• Expiration checks are based on UTC and may differ from local time.

Actual execution output

This is the result of checking the subject, validity period, and whether the local certificate is nearing expiration.

!openssl command output: certificate information and expiration

Production server

Source (HTML): https://games.aidebatehub.com/programs/linux/webserver/openssl.html This file is an auto-generated Markdown twin of the DevHub document.