gnutls-cli(1)
GnuTLS client for testing TLS/SSL connections and debugging certificate issues.
Synopsis
gnutls-cli [OPTION]... [hostname]Description
gnutls-cli is a client program that connects to a remote TLS/SSL server, allowing you to test SSL/TLS configurations, inspect certificates, and debug connection problems. It provides detailed information about the negotiated protocol version, ciphers, and certificate chain.
Useful for verifying server configurations, testing certificate validity, checking for specific protocol support (TLS 1.2, TLS 1.3, etc.), and troubleshooting SSL/TLS issues without needing a full application stack.
Common options
| Flag | What it does |
|---|---|
-p, --port PORT | connect to specified port (default 443) |
--starttls | start TLS negotiation after regular connection (useful for SMTP, IMAP, FTP) |
--starttls-proto PROTOCOL | specify protocol for STARTTLS: smtp, imap, ftp, xmpp, ldap, etc. |
-d, --debug LEVEL | enable debug output at specified verbosity level (0-9) |
--print-cert | print received certificate in PEM format |
--insecure | skip certificate verification and hostname checking |
-A, --save-cert FILE | save server certificate to file in DER format |
--crlf | convert LF to CRLF in communication |
--verbose | enable verbose logging of handshake details |
--tls13 | enforce TLS 1.3 protocol version |
--sni-hostname NAME | send specified hostname for SNI (Server Name Indication) |
Examples
connect to example.com on port 443 and establish TLS connection, showing protocol/cipher info
gnutls-cli example.comconnect to example.com on port 8443 instead of default 443
gnutls-cli -p 8443 example.comdisplay the server's certificate in PEM format
gnutls-cli --print-cert example.com | head -30test SMTP STARTTLS on Gmail's mail server
gnutls-cli --starttls-proto smtp smtp.gmail.com -p 587enable maximum debug output and filter for cipher information
gnutls-cli -d 9 example.com 2>&1 | grep -i ciphertest TLS 1.3 connection without certificate verification
echo | gnutls-cli --insecure --tls13 example.comsave certificate and immediately inspect it with openssl
gnutls-cli -A cert.der example.com && openssl x509 -inform DER -in cert.der -textshow handshake details without staying connected (non-interactive)
gnutls-cli --verbose example.com < /dev/null 2>&1 | head -20