openssl-s_client(1)
OpenSSL TLS/SSL client for testing and debugging SSL/TLS connections to remote servers.
Synopsis
openssl s_client [-connect host:port] [-servername name] [options]Description
s_client is a versatile tool for establishing TLS/SSL connections to remote servers, displaying certificate details, and diagnosing connection issues. It acts as a simple SSL/TLS client that prints the certificate chain, cipher information, and allows you to send/receive data interactively or via pipes.
Common uses include testing HTTPS servers, verifying certificate validity, checking certificate expiration dates, validating certificate chains, and debugging TLS handshake problems.
Common options
| Flag | What it does |
|---|---|
-connect host:port | Specify server and port to connect to (required unless stdin is used) |
-servername name | Set SNI (Server Name Indication) hostname for TLS handshake |
-showcerts | Display the full certificate chain from the server |
-cert file | Client certificate file (for mutual TLS authentication) |
-key file | Private key file for client certificate |
-CAfile file | File with trusted CA certificates for verification |
-CApath directory | Directory with CA certificates (for verification) |
-quiet | Suppress connection state messages |
-tls1_2 | Force TLS 1.2 protocol (also -tls1_3, -ssl3) |
-cipher ciphers | Specify cipher suites to use (e.g., 'HIGH:!aNULL') |
-starttls protocol | Use STARTTLS (smtp, pop3, imap, ftp, xmpp, xmpp-server, etc.) |
Examples
Connect to example.com on HTTPS and display certificate details
openssl s_client -connect example.com:443Connect with SNI enabled (required for servers hosting multiple TLS certificates)
openssl s_client -connect example.com:443 -servername example.comExtract certificate subject from a server without interactive mode
echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/null | grep 'subject='Check certificate expiration dates without interaction
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>&1 | openssl x509 -noout -datesTest SMTP with STARTTLS on port 587
openssl s_client -connect mail.example.com:587 -starttls smtpConnect using client certificate for mutual TLS (mTLS) authentication
openssl s_client -connect example.com:443 -cert client.crt -key client.keyForce TLS 1.3 and use only HIGH strength ciphers
openssl s_client -connect example.com:443 -tls1_3 -cipher 'HIGH'Verify certificate against a custom CA bundle
openssl s_client -connect example.com:443 -CAfile /etc/ssl/certs/ca-bundle.crt