Inspect a server's TLS certificate
Read-only
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Shows the subject, issuer, and validity dates of the TLS certificate a server presents, useful for diagnosing expiry and hostname-mismatch errors.
networktlscertificatehttps
Parameters
Hostname of the TLS server to inspect.
TLS port to connect to.
Commands
Fetch the presented certificate and print its subject, issuer, and validity window
openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesVerification
openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -checkend 0Prints "Certificate will not expire" for a currently valid certificate.
Undo
Not undoable
This recipe only reads the certificate a server presents and changes nothing.
Pitfalls
- The -servername flag matters — servers behind SNI return different certificates per hostname, so omitting it can show the wrong certificate.
- This shows only the leaf certificate; an expired intermediate in the chain can still break clients even when the leaf looks valid.
- openssl is not installed on stock Windows; use WSL, Git Bash, or a browser's certificate viewer there.