Check TLS certificates with `openssl s_client -brief`
When curl fails with a certificate error or you need the expiry date of a remote cert, s_client in brief mode prints the whole handshake story in a few lines.
Run `openssl s_client -brief -connect example.com:443 < /dev/null` to see the negotiated TLS version, cipher and server certificate chain at a glance.
01Command
Command
$ openssl s_client -brief -connect example.com:443 < /dev/null02What it does
`-brief` compresses the normally huge s_client dump into a handful of lines: protocol version, cipher, and each certificate in the chain with its expiry. Piping `< /dev/null` (or `echo | `) closes the connection immediately after the handshake so the command exits by itself. To extract just the expiry date, append `-servername example.com` for SNI and pipe into `openssl x509 -noout -dates`.
03Risk
!Warning: Without `-servername <host>` the certificate shown may be the wrong vhost's cert on shared hosting.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- openssl-s_client(1ssl) — SSL/TLS client programEvidence: Documents s_client -brief mode, which prints a concise TLS handshake summary including protocol, cipher and server certificate
- OpenSSL — ArchWikiEvidence: Shows s_client -connect examples for inspecting certificates and expiry via x509 parsing
Last verified: 2026-09-17 · Category: Security & Privacy