OpenSSL • Testing & Handshake
How to Test TLS Handshake, Protocols, and Cipher Suites with s_client
`openssl s_client` is the definitive CLI tool for testing TLS handshakes. It simulates a client connection, negotiates cipher suites, tests SNI routing, and reports handshake errors such as cipher mismatch or protocol deprecation.
Test TLS Handshake & Ciphers Command
Safe • Read-Only / File Generation
openssl s_client -connect example.com:443 -servername example.com -tls1_3 -briefCustomize:
Domain:
Cert File:
OpenSSL Flags & Options Explained
-tls1_3Forces handshake to use TLS v1.3 only (or -tls1_2)-briefPrints concise one-line summary of handshake result instead of verbose output-cipher <list>Tests specific cipher suite string against the serverExecution Steps & Verification
1Test TLS 1.3 support with brief output
Check if the server supports TLS 1.3:
openssl s_client -connect example.com:443 -servername example.com -tls1_3 -brief </dev/null2Test if legacy TLS 1.0/1.1 is properly disabled
Verify insecure protocols are rejected:
openssl s_client -connect example.com:443 -servername example.com -tls1 </dev/null3Print complete certificate chain sent by server
Check for missing intermediate certificates causing SSL errors on mobile devices:
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/nullCommon Security Pitfalls & Solutions
- If mobile clients or curl report "certificate signed by unknown authority", check `-showcerts` output. Usually the server is missing intermediate CA certificates.
Prerequisites & Environment
- Target domain reachable on TCP port 443.
Frequently Asked Questions About Test TLS Handshake & Ciphers
Frequently Asked Questions
Frequently Asked Questions
Everything you need to know regarding specifications, syntax, and security best practices.
It means the remote server's certificate chain was validated successfully against your local CA trust store.
Related OpenSSL & Security Commands
View All RecipesGeneration & Keys
How to Generate a Self-Signed SSL Certificate with OpenSSL
reqGuide →
Verification & Inspection
How to Check SSL Certificate Expiration Date from Domain or File
s_clientGuide →
Verification & Inspection
How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)
x509Guide →
Verification & Inspection
How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)
x509Guide →
Generation & Keys
How to Generate a Certificate Signing Request (CSR) with SAN
reqGuide →
Format Conversions
How to Convert PFX / PKCS#12 to PEM Certificate and Private Key
pkcs12Guide →