$ Linux One Liners
Back to commands

Web Server Rescue

Read-only, sensitive output

Show TLS Protocol and Cipher

You need to see which TLS protocol and cipher the edge negotiates.

Command

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | awk '/Protocol|Cipher|Verify return code/ {print}'

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not treat one client handshake as a full TLS policy audit.

Expected output

Protocol, cipher, and verification result from the TLS handshake.

System impact

Read-only, sensitive output. Nothing changes. The command performs a read-only TLS handshake and filters the negotiated details.

Recovery / rollback: no state is changed.

When to use it

Use when old clients fail, scanners flag TLS settings, or you need a quick negotiation snapshot.

When not to use it

Do not treat one client handshake as a full TLS policy audit.

next steps

Related commands

Web Server Rescue Sensitive output

Show TLS Certificate Dates

The outage was not the web server. The edge certificate had expired.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
Web Server Rescue Sensitive output

Show TLS Certificate Names

The cert was valid, but not for this hostname.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
Web Server Rescue Sensitive output

Check the Certificate Served for SNI

The IP was right. The SNI name selected the wrong certificate.

openssl s_client -connect example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
Linux Survival Basics Sensitive output

Show Served Certificate SANs

SANs decide which hostnames the certificate covers.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName
Linux Survival Basics Sensitive output

Read TLS Certificate Subject and Issuer

The certificate can be valid but issued for the wrong name.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

  • LPIC-1 style command-line practice
  • LFCS style performance-task practice
  • Linux+ style troubleshooting review

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.