openssl
NetworkPackage: openssl
The TLS toolbox: openssl s_client connects and shows the certificate the server actually presents, openssl x509 reads a certificate on disk. The first is what you need when the browser says "not secure" without saying why.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
openssl -dates- Prints
notBeforeandnotAfter, the certificate's two validity bounds.notAfteris the date that takes the site offline. openssl -ext- Prints only the named extension.
-ext subjectAltNamegives the names the certificate actually claims, which is the only field current clients check. openssl -noout- Does not print the certificate itself in base64: only the fields you asked for are written out.
openssl -servername- Announces that name in the TLS handshake's SNI extension. Required when
-connecttargets an IP address: without it,s_clientannounces no name and gets the default server's certificate, which invalidates any virtual-host test. openssl -connect- The host and port
s_clientconnects to, writtenhost:port. Without it,s_clienthas nowhere to go. openssl -starttls- Speaks the plaintext protocol first, then upgrades with its STARTTLS command.
-starttls smtpis what port 25 needs, where the conversation always begins in the clear.