How do I verify the live TLS certificate served by a hostname?
A TLS handshake must be checked against the intended hostname and a trusted certificate chain. OpenSSL s_client is useful for diagnosis, but its default diagnostic behaviour can continue after a verification error. Explicit hostname verification and fatal verification errors make the check more meaningful.
Before you start
- The actual HTTPS hostname.
- Network access to the service’s TLS port.
Instructions
1. Connect with the intended hostname
Replace the example name consistently. SNI tells a shared server which certificate you need; hostname verification checks that the returned certificate is valid for that name.
openssl s_client -connect app.example.com:443 -servername app.example.com -verify_hostname app.example.com -verify_return_error -brief </dev/nullPerforms a TLS handshake, checks the hostname and chain, and fails on verification errors. The input redirect makes this a non-interactive check.
2. Read the verification result
Check the reported verification outcome, protocol and peer identity. A completed TCP connection or displayed certificate alone is insufficient evidence of trust. Record the hostname and test time when comparing results across endpoints.
3. Check application behaviour separately
After a valid handshake, make an ordinary HTTPS request. TLS can succeed while the application returns an error.
curl --head --connect-timeout 5 --max-time 15 https://app.example.com/Checks the HTTP service using normal TLS validation.
Check the result
- Certificate verification succeeds for the exact hostname and the subsequent HTTPS response is appropriate.
Troubleshooting
- Unable to get local issuer certificate
- Check both the server’s intermediate chain and the client’s trusted CA store. Do not conclude that the leaf certificate is invalid from that message alone.
- Hostname mismatch
- Inspect DNS, SNI routing and certificate names for the requested endpoint.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.