Connect with openssl s_client

The s_client command is a diagnostic TLS client. It opens a real TLS connection to a server and prints the raw facts about the handshake: which certificates the server sent, which protocol version and cipher were negotiated, and whether verification passed.

You reach for it when a browser or application reports a vague TLS error and you need to see what actually happened on the wire.

Inspect a public HTTPS endpoint:

openssl s_client -connect example.org:443 -servername example.org </dev/null

Two options matter here. -connect gives the TCP target. -servername sends SNI (Server Name Indication), the hostname the client requests during the handshake. Many servers host several sites on one IP address and use SNI to select the matching certificate. For name-based servers, send SNI with -servername so the server selects the intended certificate. Skip it and you may be handed a default certificate that has nothing to do with the site you wanted to test.

The </dev/null redirect closes standard input right away, so the command exits after the handshake instead of sitting there waiting for you to type application data.

What to read in the output

The output is long. Scan for these lines:

Certificate chain
 0 s:CN = example.org
   i:C = US, O = DigiCert Inc, CN = DigiCert Global G3 TLS ECC SHA384 2020 CA1
...
Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384
...
Verify return code: 0 (ok)

The Certificate chain block lists what the server presented, with s: for subject and i: for issuer. Protocol and Cipher show what was negotiated. Verify return code: 0 (ok) means the chain validated against your local trust store. Any other code names a specific failure: 10 means an expired certificate, 20 means OpenSSL could not find the issuer.

A Verify return code of 0 proves a TLS conversation, not application health. The service behind it can still be down or broken, so treat this as a transport-layer check only.

One habit to build now: s_client output ends up in tickets and chat logs. Do not paste private keys or real client credentials into diagnostic commands or shared output.