ToolXON Blog

SSL Certificate Checking Commands

SSL Certificate Checking Commands

SSL certificate checking commands: Inspect TLS certificates, validity dates, issuers and handshake failures across OpenSSL, curl, Java and Windows. Never disable verification as a permanent fix. This guide explains what each command does, its syntax, practical examples, useful options, and common mistakes. Commands are shown for typical installations; flags can vary across operating-system and tool versions.

Before you start

Open a terminal appropriate for the operating system shown in the examples. Check that the required tool is installed and that you are running it with the permissions needed for your task. Replace sample names, paths, hostnames and IDs with values from your own environment.

Syntax at a glance

Square brackets usually indicate optional arguments, while uppercase words such as FILE, HOST and PACKAGE are placeholders that you replace. Keep quotes around paths or text that contains spaces. Commands should be tested on a safe sample before being used in production.

Quick command reference

CommandWhat it doesExampleUseful options
openssl s_clientInspect a TLS handshake and server certificateopenssl s_client -connect example.com:443 -servername example.com -showcerts displays chain certificates; -verify_return_error makes verification failure visible
curl -IvInspect TLS connection and HTTP headerscurl -Iv https://example.com-k disables certificate verification and should generally be avoided
openssl x509Read certificate dates and subject dataopenssl x509 -in cert.pem -noout -dates -issuer-fingerprint displays a certificate fingerprint
keytool -printcertInspect a certificate with the Java keytoolkeytool -printcert -sslserver example.com:443-file reads a certificate file instead
certutil -verifyVerify a certificate on Windowscertutil -verify site.cerOptions vary by operation and certificate chain setup

Command syntax and examples explained

1. openssl s_client

Purpose: Inspect a TLS handshake and server certificate.

Syntax

openssl s_client -connect HOST:443 -servername HOST

Example

openssl s_client -connect example.com:443 -servername example.com

Options and notes: -showcerts displays chain certificates; -verify_return_error makes verification failure visible.

SNI matters when multiple HTTPS sites share one IP address.

2. curl -Iv

Purpose: Inspect TLS connection and HTTP headers.

Syntax

curl -Iv URL

Example

curl -Iv https://example.com

Options and notes: -k disables certificate verification and should generally be avoided.

Do not treat success with -k as proof that a certificate is valid.

3. openssl x509

Purpose: Read certificate dates and subject data.

Syntax

openssl x509 -in CERT.pem -noout -dates -subject

Example

openssl x509 -in cert.pem -noout -dates -issuer

Options and notes: -fingerprint displays a certificate fingerprint.

Use the actual certificate file or pipe a certificate into this command.

4. keytool -printcert

Purpose: Inspect a certificate with the Java keytool.

Syntax

keytool -printcert -sslserver HOST:443

Example

keytool -printcert -sslserver example.com:443

Options and notes: -file reads a certificate file instead.

This is useful in Java environments; verify fingerprints against a trusted source.

5. certutil -verify

Purpose: Verify a certificate on Windows.

Syntax

certutil -verify CERT.cer

Example

certutil -verify site.cer

Options and notes: Options vary by operation and certificate chain setup.

Certificate verification depends on the local trust store and revocation availability.

Common mistakes and troubleshooting

  • Command not found: confirm the tool is installed and available on your PATH; open a new terminal after changing PATH.
  • Permission denied: verify the current account, file permissions and target path. Use administrator/root privileges only when genuinely required.
  • Unexpected output: check the command version, quoting, current directory and exact arguments. Consult the local help or manual for options supported by your build.
  • Destructive operations: preview the target and keep a backup before deleting data, rewriting history, flashing a partition or changing system configuration.

Safety tips

Review every command before running it, especially commands that delete files, change permissions, flash firmware, alter a database or expose a network service. For network scanning and remote administration, work only on devices and systems you own or are authorized to test. Keep credentials, private keys, access tokens and log files private.

Frequently asked questions

Do these commands work on every system?

Not always. Some commands are specific to Windows, Linux, Android, a particular package manager or an installed tool version. Use the syntax shown for your platform and check local help when a flag is unavailable.

Can I copy and run every example exactly?

Use the examples as templates. Replace placeholders such as filenames, package IDs, hostnames and paths with your own values, and verify the effect before executing a command that changes data or system state.

Conclusion

Use this reference as a starting point, then confirm flags in the tool’s official help or manual for your installed version. A clear understanding of syntax, options and side effects makes command-line work more reliable.

Networking & Security