Inspect certificates and test TLS from a shell.

openssl

What certificate is a host actually serving

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject

Check which name was validated

openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | grep -A2 'Verification'

Test a protocol version

openssl s_client -connect example.com:443 -tls1_2 </dev/null

Renew before expiry

certbot renew --dry-run

A chain with an intermediate missing shows as an error in curl but not here, because s_client fetches what the server offers. Verify with curl -I as well.

Scope: openssl