Web Server Rescue

Read-only, sensitive output

Show TLS Protocol and Cipher

You need to see which TLS protocol and cipher the edge negotiates.

Command

openssl s_client -connect edge.test:443 -servername edge.test </dev/null 2>/dev/null | awk '/Protocol|Cipher|Verify return code/ {print}'

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not treat one client handshake as a full TLS policy audit.

Expected output

Protocol, cipher, and verification result from the TLS handshake.

System impact

Read-only, sensitive output. Nothing changes. The command performs a read-only TLS handshake and filters the negotiated details.

Recovery / rollback: no state is changed.

When to use it

Use when old clients fail, scanners flag TLS settings, or you need a quick negotiation snapshot.

When not to use it

Do not treat one client handshake as a full TLS policy audit.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | sed -n '1,8p'

CONNECTED(00000003)
Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384
Verify return code: 0 (ok)
-----BEGIN CERTIFICATE-----
FIXTURE-edge
-----END CERTIFICATE-----

$ openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | awk '/Protocol|Cipher|Verify return code/ {print}'

Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384
Verify return code: 0 (ok)

View commands shown

These are the commands shown in the sanitized transcript.

Commands shown

openssl s_client -connect edge.test:443 -servername edge.test </dev/null 2>/dev/null | sed -n '1,8p'
openssl s_client -connect edge.test:443 -servername edge.test </dev/null 2>/dev/null | awk '/Protocol|Cipher|Verify return code/ {print}'

next steps

Related commands

Web Server Rescue Sensitive output

Show TLS Certificate Names

The cert was valid, but not for this hostname.

openssl s_client -connect edge.test:443 -servername edge.test </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

Web Server Rescue Sensitive output

Show TLS Certificate Dates

The outage was not the web server. The edge certificate had expired.

openssl s_client -connect edge.test:443 -servername edge.test </dev/null 2>/dev/null | openssl x509 -noout -dates

Web Server Rescue Sensitive output

Check the Certificate Served for SNI

The IP was right. The SNI name selected the wrong certificate.

openssl s_client -connect 203.0.113.10:443 -servername wrong.edge.test </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

Web Server Rescue Can be slow

Find Large Directories with du

Once you know a filesystem is full, the next question is where.

du -xh --max-depth=1 /var 2>/dev/null | sort -h

Web Server Rescue Read-only

Smoke Check an HTTP Status

A deploy is not done until the endpoint answers.

curl -fsS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com/health

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Show TLS Protocol and Cipher

Before you run this

Expected output

System impact

When to use it

When not to use it

Command transcript

Commands shown

Related commands

Show TLS Certificate Names

Show TLS Certificate Dates

Check the Certificate Served for SNI

Find Large Directories with du

Smoke Check an HTTP Status

Useful for