Skip to main content
This article describes how to use the openssl program to troubleshoot SSL connections.

​
About OpenSSL

OpenSSL is an open-source implementation of the SSL and TLS protocols. It includes several code libraries and utility programs, one of which is the command-line openssl program. The openssl program is a useful tool for troubleshooting secure TCP connections to a remote server. In addition to testing basic connectivity, openssl enables you to send raw protocol commands for additional testing.
To test non-secure connections, use the telnet program instead. For information about how to do this, please see this article.

​
Installing the openssl program

Linux and macOS include the openssl program by default. On Microsoft Windows, however, you must download and install openssl. To do this, follow these steps:
  1. Use your web browser to visit https://github.com/openssl/openssl/wiki/Binaries.
  2. Click the OpenSSL for Windows hyperlink that includes Pre-compiled Win32/64 libraries without external dependencies.
  3. Download the most recent OpenSSL version for your PC architecture:
  • If you have a 32-bit computer, select a file whose name ends in win32.zip. For example, at the time this article is written, the newest version is openssl-1.0.2d-i386-win32.zip.
  • If you have a 64-bit computer, select a file whose name ends in win64.zip. For example, at the time this article is written, the newest version is openssl-1.0.2d-x64_86-win64.zip.
  1. Extract the .zip file to a folder (you can use any folder, and you can name the folder anything you want).
  2. After you extract the files, the folder contains the openssl.exe file and supporting files.
  3. To run openssl, open a command prompt window, use the cd command to change to the folder where you extracted the files in step 5, and then type openssl.

​
Using the openssl program to troubleshoot

To troubleshoot a secure connection using the openssl program, you must know at least two things:
  • The remote server name or IP address.
  • The port number for the network application you want to test.
If you are only testing basic connectivity to a particular application, that is all you need. If you want to do more in-depth testing, however, you will need to know specific commands for the protocol you want to test (for example, IMAP or HTTP).

​
Establishing a connection

To open a connection to a remote server, open a terminal window on your computer, and then type the following command. Replace example.com with the domain name (or IP address) of the server, and replace port with the TCP port number of the protocol you want to test:
For a complete list of assigned TCP port numbers, please visit http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers.
When you try to establish a secure connection to a remote server using openssl, one of two things happens:
  • The server accepts the connection. If this happens, openssl may display some text from the server, or simply await further input. You can then send raw commands appropriate for the protocol you are testing.
  • The server rejects the connection. If this happens, you receive a message such as connect: Connection timed out or connect:errno=110. If you receive this message, confirm you are using the correct server and port number. If you are, then the server is not accepting secure connections on the specified port.
The following sections demonstrate how to do basic troubleshooting with some common types of secure connections.

​
Troubleshooting SSL certificates

You can use the openssl program to test and verify SSL certificates. For example, you can check whether a certificate is signed by a valid Certificate Authority (CA) or is self-signed. You can also examine the certificate’s validity, expiration date, and much more. To do this, type the following command. Replace example.com with your own domain name:
SSL certificates are most commonly used to secure web sites, so the command above uses port 443 (HTTPS). However, if you have an unmanaged server, you may be using an SSL certificate to secure other services (for example, IMAP or Asterisk) instead of HTTP. If so, use the port number for that protocol instead.
The following sample output shows some important lines marked in bold:
In this output, you can see that the certificate is issued by a Certificate Authority (CA) and uses a SHA-256 fingerprint. Additionally, the certificate expires on June 11, 2016.
If this were a self-signed certificate, openssl would display the following lines:

​
Troubleshooting HTTP connections

Web server testing is a very common troubleshooting scenario. With openssl, you can open a secure connection to a remote server on port 443, and then send raw HTTP commands. For example, the following text shows an exchange between an openssl client and a remote web server:
In this exchange, openssl opens a connection to example.com on port 443 (HTTP secure port). The user receives information about the SSL certificate, as well as the ciphers that are in use. The user then sends a raw HTTP command (HEAD). The HTTP response confirms that the web server is accepting connections and responding to requests on port 443. Similar to the procedure for web server troubleshooting, you can test secure POP (port 995) and IMAP (port 993) connectivity. The following text shows a sample exchange between an openssl client and a remote IMAP server:
The responses show that the server is accepting connections and responding to requests on port 993. Additionally, the line that starts with *OK shows that IMAP is running and ready for requests.

​
More information

For more information about OpenSSL, please visit https://www.openssl.org.