Testing an SSL Connection with OpenSSL

To test an SSL connection using OpenSSL, the most direct command is openssl s_client -connect host:port, which establishes a raw TLS/SSL session and prints the server’s certificate, cipher negotiation, and handshake details. This article explains how to use this command effectively, interpret its output, and troubleshoot common connection issues.

Formula

This calculator is not related to OpenSSL; it demonstrates a typical speed/pace calculation: Speed (km/h) = Distance (km) / Time (hours). Time is converted from seconds to hours by dividing by 3600. Pace (min/km) = Time (minutes) / Distance (km). Variables: t = time in seconds, d = distance in kilometers.

Worked Example

Using defaults: t = 5 sec, d = 1 km. Speed = 1 / (5/3600) = 1 / 0.0013889 = 720 km/h. Pace = (5/60) / 1 = 0.0833 min/km. The result shows 720.00 km/h and 0.08 min/km.

Why Test an SSL Connection?

Testing an SSL/TLS connection is a routine task for system administrators, developers, and security-minded users. It verifies that a server is properly configured to serve HTTPS, that the certificate chain is valid, and that the chosen protocol and cipher suite meet security standards. OpenSSL provides a command-line tool that gives you direct access to the TLS handshake, bypassing web browsers and their built-in error handling. This is especially useful when a browser shows a warning, when you need to debug an API endpoint, or when you want to check if a server supports a specific TLS version.

How OpenSSL s_client Works

The s_client command is a diagnostic tool that acts as a TLS client. It connects to a host and port, performs the handshake, and then allows you to send raw data (or just observe the handshake). The output includes:

• Certificate chain: Each certificate in the chain, from the server’s leaf certificate up to the root.
• Server certificate details: Subject, issuer, validity dates, and public key info.
• Negotiated protocol and cipher: e.g., TLSv1.3, TLS_AES_256_GCM_SHA384.
• Session details: Session ID, session ticket, and verification result.

By default, s_client does not verify the certificate chain; it only prints the certificates. To actually verify the chain, you need to add the -verify_return_error and -CAfile options (or use -verify_hostname).

Basic Command and Options

The fundamental command is:

openssl s_client -connect example.com:443

This connects to example.com on port 443 (HTTPS) and displays the handshake. Common options to tailor the test:

• -servername example.com: Required for SNI (Server Name Indication) if the server hosts multiple virtual hosts.
• -tls1_2 or -tls1_3: Force a specific TLS version to test compatibility.
• -cipher 'ECDHE-RSA-AES128-GCM-SHA256': Test a specific cipher suite.
• -showcerts: Display the full certificate chain (default is only the server cert).
• -brief: Print only essential information (protocol, cipher, and verification).
• -verify_return_error: Fail if certificate verification fails.
• -CApath /etc/ssl/certs: Use system CA certificates for verification.

Interpreting the Output

After running the command, you’ll see a block of text. Key lines to look for:

• Subject: The domain name the certificate is issued to. It should match the hostname you connected to.
• Issuer: The certificate authority (CA) that signed it.
• Not Before / Not After: Validity period; check if the current date is within.
• Verify return code: At the end, it shows a number and text. A value of 0 (ok) means verification passed (if you used verification options). Non-zero codes like 18 (self-signed certificate) or 21 (unable to verify the first certificate) indicate issues.
• Cipher is: The negotiated cipher suite, e.g., ECDHE-RSA-AES256-GCM-SHA384.

If you just want a quick summary, use -brief to see only the essential lines.

Common Problems and How to Fix Them

When testing, you may encounter errors. Here are typical ones and what they mean:

• Connection refused: The port is closed or the server isn’t listening. Check the hostname and port.
• Certificate expired: The server’s certificate is out of its validity period. Renew it.
• Hostname mismatch: The certificate’s Subject or Subject Alternative Names (SAN) don’t include the hostname you used. Use -servername to match the certificate.
• Self-signed certificate: The server uses a certificate not signed by a trusted CA. For testing, you can add -CAfile server.crt to trust it explicitly.
• TLS version mismatch: The server doesn’t support the version you forced. Try without -tls1_2 or use -tls1 (though TLS 1.0 is deprecated).

Always check the exact error message; OpenSSL is usually descriptive.

Alternatives to OpenSSL s_client

While OpenSSL is ubiquitous, other tools offer more user-friendly output:

• curl -vI https://example.com: Shows the TLS handshake details and certificate info.
• nmap –script ssl-cert: Enumerates the certificate and checks for vulnerabilities.
• GnuTLS’s gnutls-cli: Similar to s_client but with different options.
• Online SSL checkers: e.g., SSL Labs, but they only work for public servers.

These are good for quick checks, but OpenSSL remains the most flexible and scriptable.

Frequently Asked Questions

How do I test an SSL connection without verifying the certificate?

By default, s_client does not verify the certificate. It just prints it. So the basic command openssl s_client -connect host:port will connect and show the handshake even if the certificate is invalid. To force verification, add -verify_return_error and specify a CA file or path.

How can I check which TLS version a server supports?

Run openssl s_client -connect host:port -tls1_2 and see if it succeeds. Then try -tls1_3. If the connection fails, that version is not supported. You can also use -brief to see the negotiated protocol.

What does ‘Verify return code: 18’ mean?

Code 18 means

Related

• Best Leaf Blowers to Buy This Fall: 5 Picks
• Fix a Local AI Agent That Cannot Connect to Its Model
• How to Tune Slicer Settings for a New Filament

in t | Time to connect | sec | 5 | 0
in d | Distance | km | 1 | 0
out speed | Speed | km/h | d / (t / 3600) | 2
out pace | Pace | min/km | t / d | 2