adminOpenSSL S Client SSL Debugging Checklist
openssl s_client helps system admins inspect TLS and SSL connections from the terminal. It is useful when browsers show certificate warnings, Nginx SSL setup fails, CDN behavior is confusing or certificate chains are incomplete.
Core principle
SSL is a connection negotiation. The client connects to a hostname, receives a certificate, checks the chain and verifies that the certificate matches the requested name.
Checklist
- Check the HTTPS endpoint with curl first.
- Use openssl s_client with the correct server name.
- Check certificate subject and issuer.
- Check certificate expiration.
- Check whether the certificate chain is complete.
- Check whether SNI is required.
- Compare origin SSL with CDN SSL if used.
- Check Nginx SSL config if certificate is wrong.
- Reload Nginx only after config test passes.
- Document certificate source and renewal method.
Reusable lesson
This applies to Nginx SSL, Certbot, Cloudflare origin certificates, API endpoints, webhooks, admin dashboards and monitoring checks.
When to Use This Checklist
Use this checklist when debugging SSL warnings, certificate mismatch, incomplete chain, HTTPS failure or CDN origin SSL issues.
Required Tools
Terminal access, openssl, domain name, Nginx config, certificate files, CDN access if used
Before You Start
Always include the correct server name when testing SNI-based HTTPS websites.
Structured Checklist Steps
- Check HTTPS with curl.
- Run openssl s_client.
- Check subject.
- Check issuer.
- Check expiration.
- Check chain.
- Check SNI.
- Compare CDN and origin.
- Validate Nginx.
- Document renewal method.
Verification Steps
- Certificate matches hostname.
- Certificate is not expired.
- Chain is valid.
- Nginx config test passes.
- Renewal source is known.
Rollback Plan
If SSL config changes break HTTPS, restore the previous Nginx SSL block, run nginx -t and reload only after validation passes.
Common Mistakes
- Testing without SNI.
- Confusing CDN certificate with origin certificate.
- Ignoring certificate chain.
- Reloading Nginx without config test.
- No renewal documentation.
Related Commands
curl -I https://example.com
openssl s_client -connect example.com:443 -servername example.com
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subject
sudo nginx -t
sudo systemctl reload nginx