Network Troubleshooting / IT Support Guides
Inspect an HTTPS certificate chain with OpenSSL
A browser certificate warning may come from expiry, name mismatch, an incomplete chain or managed inspection. Inspect the presented chain using the correct hostname indication.
Environment and inputs: Mixed platforms · each example identifies its shell or required tool
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com -verify_return_error -showcertsHow to read the result
On a system with OpenSSL, the command presents the server's certificate chain and reports verification results using that tool's trust store. Ctrl+C or end-of-input closes an interactive connection.
What to do next
Compare the certificate names, validity and issuer with the expected service. Reproduce using the affected client's trust context because OpenSSL and the browser may trust different authorities.
Before you make a change
Do not suppress verification errors or install an unverified root certificate. The example is an inspection request and does not repair the server chain.