$ Linux One Liners
Back to commands

Web Server Rescue

Read-only, sensitive output

Check the Certificate Served for SNI

You need to prove which certificate an edge returns for a specific SNI hostname.

Command

openssl s_client -connect example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not omit -servername when testing hostname-specific TLS behavior.

Expected output

The certificate identity fields selected by the requested SNI name.

System impact

Read-only, sensitive output. Nothing changes. The command performs a read-only TLS handshake with an explicit server name.

Recovery / rollback: no state is changed.

When to use it

Use when the same IP serves multiple sites or a CDN returns the default certificate.

When not to use it

Do not omit -servername when testing hostname-specific TLS behavior.

next steps

Related commands

Web Server Rescue Sensitive output

Show TLS Certificate Names

The cert was valid, but not for this hostname.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
Web Server Rescue Sensitive output

Show TLS Certificate Dates

The outage was not the web server. The edge certificate had expired.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
Linux Survival Basics Sensitive output

Show Served Certificate SANs

SANs decide which hostnames the certificate covers.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName
Linux Survival Basics Sensitive output

Read TLS Certificate Subject and Issuer

The certificate can be valid but issued for the wrong name.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Web Server Rescue Sensitive output

Show TLS Protocol and Cipher

The certificate was fine. The TLS negotiation told the rest of the story.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | awk '/Protocol|Cipher|Verify return code/ {print}'
Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

  • LPIC-1 style command-line practice
  • LFCS style performance-task practice
  • Linux+ style troubleshooting review

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.