Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

When a TLS connection fails, one of the most useful troubleshooting tools available to DevOps engineers is OpenSSL s_client. This command allows you to connect to a remote server, inspect the certificate chain, and view TLS handshake details directly from the command line.

This article is part of the PKI for DevOps Engineers training series. In the previous lesson we explained certificate chains. In this lesson you will learn how to debug TLS connections using OpenSSL.

If you want a complete reference for the command, see our full guide on openssl s_client.

—

Table of Contents

—

What is OpenSSL s_client?

openssl s_client is a diagnostic tool included with OpenSSL that allows you to establish TLS connections from the command line.

It is commonly used to:

  • inspect server certificates
  • retrieve certificate chains
  • debug TLS handshake failures
  • verify protocol versions and ciphers
  • test hostname validation

Because it exposes the raw TLS handshake, it is one of the most valuable tools for diagnosing certificate and encryption issues.

—

Basic TLS connection test

The simplest way to test a TLS connection is to connect to a server and port.

openssl s_client -connect example.com:443

This command establishes a TLS connection and prints detailed information including:

  • the certificate chain
  • cipher suite used
  • TLS version negotiated
  • verification status

One of the most important sections in the output is the verification result.

Verify return code: 0 (ok)

If the certificate fails validation, this return code will indicate the failure reason.

—

View the certificate chain

You can instruct OpenSSL to display all certificates presented by the server.

openssl s_client -connect example.com:443 -showcerts

This command returns the entire certificate chain sent by the server.

If you want to verify the chain manually, see our guide on openssl verify.

You can also pipe the output to view the certificate fields.

openssl s_client -connect example.com:443 | openssl x509 -noout -text

This makes it easy to inspect certificate extensions, SAN entries, and validity dates.

If you want a deeper explanation of certificate structure, see X.509 certificates explained.

—

Check hostname validation

When testing TLS connections behind load balancers or reverse proxies, hostname validation is important.

You can explicitly specify the server name using the -servername option.

openssl s_client -connect example.com:443 -servername example.com

This enables SNI (Server Name Indication), which allows a server to present different certificates depending on the requested hostname.

Without SNI, the server may return a default certificate that does not match the expected hostname.

—

Test specific TLS versions

Sometimes TLS connections fail because of protocol version mismatches.

You can force OpenSSL to use a specific TLS version.

openssl s_client -connect example.com:443 -tls1_2

Other supported options include:

  • -tls1
  • -tls1_1
  • -tls1_2
  • -tls1_3

This is useful when diagnosing compatibility issues between legacy servers and modern clients.

—

Common TLS debugging scenarios

DevOps engineers frequently use OpenSSL when diagnosing TLS issues in production systems.

Some common scenarios include:

  • certificate expiration
  • invalid hostname errors
  • missing intermediate certificates
  • unsupported TLS protocol versions
  • misconfigured load balancers

Understanding how to inspect TLS connections with OpenSSL makes these issues much easier to identify and resolve.

If you need a refresher on how certificate chains work, see our article on certificate chains.

—

Frequently Asked Questions

What is openssl s_client used for?

openssl s_client is used to test TLS connections, inspect certificates, and debug SSL or TLS configuration issues.

How do I view the certificate chain of a website?

You can retrieve the chain using:

openssl s_client -connect example.com:443 -showcerts

Why do TLS connections fail?

Common causes include expired certificates, missing intermediate certificates, unsupported TLS versions, and hostname mismatches.

How do I verify certificates manually?

You can validate certificates using the openssl verify command.

—

Next Lesson

Now that you understand how to debug TLS connections, the next lesson will walk through how to create certificate signing requests using OpenSSL.

Lesson 5 – Create a CSR with OpenSSL →

—

Training Series Navigation