How to check SSL certificate from command line

Two commands joined by a pipe. openssl s_client -connect example.com:443 -servername example.com </dev/null fetches the served certificate, and openssl x509 -noout -subject -issuer -dates -serial prints its identity fields. Add -text to read everything the authority signed, or -fingerprint -sha256 to compare what is deployed against what was issued.

Why check this

The certificate a server sends is the only one that matters, and it is often not the file sitting in the deployment repository. A reload that never happened, a stale bundle on one node of three, a wildcard swapped for a single-name certificate: each of those passes a file review and fails in production. Run this after every certificate deployment, against each origin node by IP as well as the public hostname, before you sign the release off.

Prerequisites

• openssl 1.1.1 or later. See the x509 manual for the printing flags used below.
• Outbound access to port 443 on the host under test.
• A writable directory for step 3, which saves the certificate to a file.

Steps

1. 1

   Step 1.

   Get the one-line verdict on the handshake before reading any field.

   openssl s_client -brief -connect example.com:443 -servername example.com </dev/null
   

   CONNECTION ESTABLISHED
   Protocol version: TLSv1.3
   Ciphersuite: TLS_AES_256_GCM_SHA384
   Peer certificate: CN = example.com
   Hash used: SHA256
   Signature type: ECDSA
   Verification: OK
   Server Temp Key: X25519, 253 bits
   DONE

   Verification: OK means openssl built a path to a root it trusts. Any other value is the real finding, and the fields below only explain it.

2. 2

   Step 2.

   Print the identity fields.

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -serial
   

   subject=CN = example.com
   issuer=C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing ECC CA 3
   notBefore=Jul 29 22:10:08 2026 GMT
   notAfter=Oct 27 22:17:21 2026 GMT
   serial=0624D0AB311558780B7D5213B9631831

3. 3

   Step 3.

   Save the served certificate so you can read it offline and attach it to a ticket.

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -outform PEM | tee example.pem | head -3
   

   -----BEGIN CERTIFICATE-----
   MIID5jCCA42gAwIBAgIQBiTQqzEVWHgLfVITuWMYMTAKBggqhkjOPQQDAjBRMQsw
   CQYDVQQGEwJVUzEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMSgwJgYDVQQDDB9D

   The file is the leaf only. Everything after step 3 reads this file, so the server sees no further traffic.

4. 4

   Step 4.

   Read the decoded certificate from the file.

   openssl x509 -in example.pem -noout -text | head -22
   

   Certificate:
     Data:
         Version: 3 (0x2)
         Serial Number:
             06:24:d0:ab:31:15:58:78:0b:7d:52:13:b9:63:18:31
         Signature Algorithm: ecdsa-with-SHA256
         Issuer: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing ECC CA 3
         Validity
             Not Before: Jul 29 22:10:08 2026 GMT
             Not After : Oct 27 22:17:21 2026 GMT
         Subject: CN = example.com
         Subject Public Key Info:
             Public Key Algorithm: id-ecPublicKey
                 Public-Key: (256 bit)
                 …
                 ASN1 OID: prime256v1
                 NIST CURVE: P-256

5. 5

   Step 5.

   Take the fingerprint, which is the only field that identifies one exact certificate.

   openssl x509 -in example.pem -noout -fingerprint -sha256
   

   sha256 Fingerprint=61:53:A9:6F:D1:A6:AB:7F:4D:43:8F:C3:49:32:48:42:99:D0:72:9D:91:40:B3:A1:26:BB:2F:9C:07:B0:22:00

How to read the result

| What you see | What it means | What to do | | --- | --- | --- | | Verification: OK | A trusted path was built on this machine | Move on to the field checks. | | Verification error: … | The chain, the dates or the hostname failed | Read the named error before anything else. | | subject= with no CN | The name lives only in the extension list | Read the Subject Alternative Name, not the subject. | | Fingerprint differs between two nodes | The nodes serve different certificates | A partial deployment. Reload the lagging node and repeat. |

Common mistakes

What to check next

• How to check SSL certificate expiry: turn notAfter into days remaining and an exit code.
• How to check certificate chain: the leaf alone does not prove a client can build a path.
• How to check certificate SAN: the names the certificate is actually valid for.
• How to check TLS version of a website: the protocol half of the same handshake.
• Ssl certificate checker: the same fields without a terminal.

FAQ

How to check an SSL certificate with openssl?

openssl s_client speaks TLS and prints the certificate, openssl x509 decodes it. Keep them separate and join them with a pipe. Point x509 at a file with -in when the certificate is already on disk.

How to check an SSL certificate in Linux?

The same commands. Distribution packages name the binary openssl on Debian, Ubuntu, Fedora and Alpine. The trust store differs, so Verification: OK on one machine and a failure on another usually means a missing root package, not a server change.

How to check a certificate fingerprint?

Step 5. Use sha256 and compare the full string. A fingerprint changes on every reissue, including a renewal of the same names, so it answers "is this the exact certificate I issued" and never "is this the right domain".

How to check if a certificate matches its private key?

Hash the modulus of each and compare: openssl x509 -in c.pem -noout -modulus | openssl sha256 against openssl rsa -in k.pem -noout -modulus | openssl sha256. Identical digests mean they pair. For an EC key compare -pubkey output instead.

Can I read a certificate without openssl?

curl -v https://example.com/ -o /dev/null prints subject, issuer, start date and expire date from its own TLS layer. It cannot print extensions or a fingerprint, so use it as a smoke test and openssl for the detail.

Verified