Openssl S_client -connect -showcerts
You run the openssl s_client connect showcerts workflow to inspect a server certificate chain. This command opens a test TLS link and prints every public certificate in full. Teams use this check to find expired keys or missing intermediate certificates fast. Yet giving engineers direct network paths and broad roles to run checks creates risk. Wide network permissions let anyone probe internal ports and read sensitive traffic data. How the openssl s_client connect showcerts workflow operates
Client-Initiated Backchannel Authentication (CIBA): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You run the openssl s_client connect showcerts workflow to inspect a server certificate chain. This command opens a test TLS link and prints every public certificate in full. Teams use this check to find expired keys or missing intermediate certificates fast. Yet giving engineers direct network paths and broad roles to run checks creates risk. Wide network permissions let anyone probe internal ports and read sensitive traffic data.
How the openssl s_client connect showcerts workflow operates
The OpenSSL client tool acts as a simple test client for secure network ports. You give the tool a target host name and a port number to start. The tool opens a raw socket to that remote server over the network. Next, it starts a standard TLS handshake with the remote port. During this handshake, the server sends back its public certificate chain. By default, the client only prints a short summary of the leaf certificate.
Adding the show certificates option changes how the tool prints the server response. It tells the client to output the full text of every certificate sent. You see the base64 encoded blocks for the server and intermediate authorities. The tool also prints the subject name and the issuer name for each item. At the end, it shows a return code that marks if local trust succeeded. Note that the tool keeps the session active waiting for input after the handshake finishes. Engineers close the input stream right away so the test exits clean.
What native certificate checks solve and what they leave open
This native workflow is great for finding broken trust chains on remote servers. A web app might fail to talk to an internal API over TLS. The test output shows right away if the server forgot an intermediate certificate. It also reveals when a certificate has passed its valid date range. Teams can save the printed blocks to update a local trust store file.
Still, running these checks requires direct network routes from the user machine. Engineers often need VPN profiles or broad firewall rules to reach internal ports. Once a user has network access to test a port, they can send data. Network rules only check which IP address opens the socket to the server. They do not inspect the commands or queries sent inside the session. A user with port access could connect a database client or run live commands. Relying on broad network roles leaves internal services exposed to unchecked commands in flight.
Client-Initiated Backchannel Authentication (CIBA): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Reading the certificate chain and trust output
When you read the output, look at the numbered list at the top first. Level zero is always the leaf certificate that belongs to the target host. Level one and higher show the intermediate authorities that signed the previous key. Each level displays a subject line and an issuer line in plain text. The issuer of level zero must match the subject of level one.
If the server sends a root certificate, it appears at the bottom. Most servers leave out the root because clients already have it in local storage. Below the encoded blocks, the tool prints the negotiated cipher and protocol details. If the verify return code is not zero, the local machine lacks a root. When the host uses virtual hosting, you must also pass the server name indicator. Without the server name, the host may return a default fallback certificate instead.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Why does the OpenSSL test hang after printing the certificates?
The client opens an interactive session and waits for you to type protocol commands. Send an end of file signal or pipe empty input to close it fast.
Why did the server return the wrong certificate for my domain?
Modern servers host many domains on one IP address using server name indication. You must tell the client to send the exact host name during the handshake.
Does this command show the root certificate from the server?
It only shows the root if the server sends it during the handshake. Most servers stop at the last intermediate key and rely on your local store.