Testing a certificate properly

Your browser holds cached intermediates, remembers earlier visits, and is forgiving. It is the last thing to test with, not the first. These commands ask the server directly and nothing is cached.

1. Does it verify at all

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null \
  | grep -E 'Verify return code|^ *[0-9]+ s:'

Verify return code: 0 (ok) and at least two certificates listed. Anything else is an incomplete chain.

2. Which names it covers

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null \
  | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

3. When it expires

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null \
  | openssl x509 -noout -dates

4. Every subdomain, not just the main one

for h in www shop api mail staging; do
  printf '%-8s ' "$h"
  echo | openssl s_client -connect "$h.yourdomain.com:443" -servername "$h.yourdomain.com" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null || echo "no certificate"
done

5. Without a cache, as a stranger

curl -sS -o /dev/null -w '%{http_code} %{ssl_verify_result}\
' https://yourdomain.com/
# ssl_verify_result 0 is correct

6. Old protocols, which should be refused

openssl s_client -connect yourdomain.com:443 -tls1_1 < /dev/null 2>&1 | tail -3
# a handshake failure here is the CORRECT result

Then monitor the expiry

0 8 * * * /usr/local/bin/check-cert.sh yourdomain.com 21   # warn 21 days out