1. When to use it
Useful when HTTPS fails ambiguously and you need to verify whether the issue is certificate, SNI, or protocol related.
openssl s_client | TLS | certificate chain | SNI | debug
2. Base setup
openssl s_client -connect example.org:443 -servername example.org </dev/null
openssl s_client -connect mail.example.org:993 -servername mail.example.org </dev/null
openssl x509 -in server.crt -noout -dates -subjectAdjust host names, IPs, interfaces, paths, and versions to the real system before making the change persistent.
3. Quick verification
openssl verify -CAfile ca-chain.pem server.crt
openssl x509 -in server.crt -noout -issuer -serial
grep -n 'Verify return code' /tmp/tls-debug.log 2>/dev/nullConfirm that the output matches the expected state before considering the intervention complete.
4. Operational notes
When the service uses TLS virtual hosts, always remember -servername: without SNI you are testing a different scenario.
Quick checklist
[ ] Steps completed\n[ ] Config updated\n[ ] Tests executed\n[ ] Rollback ready\n[ ] Logs checked