Rafael Pfister

TLS / OpenSSL

Check certificates, expiry, chain and protocols.

Show certificate

Fetches the server certificate and shows subject, issuer and validity period.

HTTPS (443)

PowerShell (Windows)

SslStream (.NET) Built-in 

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
$cert | Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint
$ssl.Dispose(); $c.Close()

openssl Add-on tool 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>$null | openssl x509 -noout -subject -issuer -dates

Unix shell (bash)

openssl Built-in 

openssl s_client -connect mail.example.com:443 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

gnutls-cli Add-on tool 

gnutls-cli --print-cert mail.example.com:443 </dev/null

Outlook Web App

PowerShell (Windows)

SslStream (.NET) Built-in 

$h = "webmail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
$cert | Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint
$ssl.Dispose(); $c.Close()

openssl Add-on tool 

"" | openssl s_client -connect webmail.example.com:443 -servername webmail.example.com 2>$null | openssl x509 -noout -subject -issuer -dates

Unix shell (bash)

openssl Built-in 

openssl s_client -connect webmail.example.com:443 -servername webmail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

gnutls-cli Add-on tool 

gnutls-cli --print-cert webmail.example.com:443 </dev/null

The { $true } callback deliberately accepts expired or self-signed certificates too, so they stay visible.

Expiry date

Shows the expiry date and whether the certificate is still valid in 30 days.

HTTPS (443)

PowerShell (Windows)

SslStream (.NET) Built-in 

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
"NotAfter {0}  ({1} days left)" -f $cert.NotAfter, ($cert.NotAfter - (Get-Date)).Days
$ssl.Dispose(); $c.Close()

openssl Add-on tool 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>$null | openssl x509 -noout -enddate

Unix shell (bash)

openssl Built-in 

echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>/dev/null | openssl x509 -noout -enddate
echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>/dev/null | openssl x509 -noout -checkend 2592000 && echo "valid >30d" || echo "expires <30d"

curl Add-on tool 

curl -sSv "https://mail.example.com:443" 2>&1 | grep -E "expire|subject:|issuer:"

Certificate chain

Shows the chain the server delivers, to spot missing intermediate certificates.

PowerShell (Windows)

X509Chain (.NET) Built-in 

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
$chain = New-Object Security.Cryptography.X509Certificates.X509Chain
$chain.ChainPolicy.RevocationMode = "NoCheck"
[void]$chain.Build($cert)
$chain.ChainElements | ForEach-Object { $_.Certificate.Subject }
$ssl.Dispose(); $c.Close()

openssl Add-on tool 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com -showcerts 2>$null

Unix shell (bash)

openssl Built-in 

openssl s_client -connect mail.example.com:443 -servername mail.example.com -showcerts </dev/null 2>/dev/null | grep -E "^ *(s:|i:)"

gnutls-cli Add-on tool 

gnutls-cli --print-cert mail.example.com:443 </dev/null 2>/dev/null | grep -E "Subject:|Issuer:"

TLS versions

Tests which TLS versions the server accepts.

HTTPS (443)

PowerShell (Windows)

SslStream (.NET) Built-in 

foreach ($proto in "Tls12", "Tls13") {
  try {
    $c = New-Object Net.Sockets.TcpClient("mail.example.com", 443)
    $ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
    $ssl.AuthenticateAsClient("mail.example.com", $null, [Security.Authentication.SslProtocols]$proto, $false)
    "$proto ok: $($ssl.SslProtocol) / $($ssl.CipherAlgorithm)"
    $ssl.Dispose(); $c.Close()
  } catch { "$proto not supported" }
}

openssl Add-on tool 

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com -tls1_2 2>$null | Select-String "Protocol"

Unix shell (bash)

openssl Built-in 

for proto in -tls1 -tls1_1 -tls1_2 -tls1_3; do
  echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com $proto >/dev/null 2>&1 \
    && echo "$proto supported" || echo "$proto not"
done

nmap Add-on tool 

nmap --script ssl-enum-ciphers -p 443 mail.example.com

.NET tests TLS 1.2 and 1.3 here; older versions are usually disabled in the framework. openssl also checks TLS 1.0/1.1.

SMTP certificate (STARTTLS)

Shows the certificate a mail server presents during STARTTLS on port 25.

SMTP (25)

PowerShell (Windows)

SslStream (.NET) Built-in 

$h = "mail.example.com"; $p = 25
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
$r.ReadLine() | Out-Null
$w.WriteLine("EHLO test.example.com"); Start-Sleep -Milliseconds 200; while ($c.Available) { $r.ReadLine() | Out-Null }
$w.WriteLine("STARTTLS"); $r.ReadLine()
$ssl = New-Object Net.Security.SslStream($s, $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotBefore, NotAfter
$ssl.Dispose(); $c.Close()

openssl Add-on tool 

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com

Unix shell (bash)

openssl Built-in 

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

swaks Add-on tool 

swaks --server mail.example.com:25 -tls --quit-after TLS

Inspect certificate file

Reads a local certificate file (PEM/CER) and shows subject, issuer and SAN.

PowerShell (Windows)

X509Certificate2 (.NET) Built-in 

$cert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 "cert.pem"
$cert | Format-List Subject, Issuer, NotBefore, NotAfter, DnsNameList, Thumbprint

openssl Add-on tool 

openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

Unix shell (bash)

openssl Built-in 

openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

certtool Add-on tool 

certtool --certificate-info --infile cert.pem

For password-protected PFX files under PowerShell, use Get-PfxCertificate instead.

Other areas