OpenSSL Debugging Hints

Debugging OpenSSL Issues

Here is a short list of some OpenSSL debugging hints and examples.

Display SSL Details

echo | openssl s_client -connect example.com:443

This will connect to the server and display the SSL details, like the certificate details, certificate chain, used encryption, verification result, etc.

Use the -servername example.com option if the server is a virtual host and uses several SSL certificates for the same IP, this will enable the SNI SSL feature.

Use -CAfile cert.pem option with if you have a custom certificate, you can verify that the connection to the server works using the specific certificate.

Dump the SSL Certificate from the Server

The previous command also dumps the certificate (in PEM format), you can either manually extract it from the output or you can use this sed command:

echo | openssl s_client -connect example.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cert.pem

Display Certificate Details

openssl x509 -in cert.pem -text -noout

This displays the certificate details in a human readable format.

Create a Self-signed Key

To create a self-signed certificate use this command:

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

The OpenSSL tool will ask for some input data interactively, like the organization name, your location, etc. For testing purposes it does not matter what you enter, feel free to use any values.

The only important value is the certificate subject, you must use the server host name otherwise the SSL verification will fail. You might even use localhost if you use the service only locally via the https://localhost address.

Start Ruby SSL Server

ruby -r webrick/https -e 'WEBrick::HTTPServer.new(Port: 8000, DocumentRoot: ".", SSLEnable: true, SSLCertificate: OpenSSL::X509::Certificate.new(File.read("cert.pem")), SSLPrivateKey: OpenSSL::PKey::RSA.new(File.read("key.pem"))).start'

Start a Testing HTTPS Server

openssl s_server -key key.pem -cert cert.pem -accept 9000 -www

CURL and Custom Certificate

curl --cacert cert.pem https://localhost:9000

If you want to verify the SSL connection to the server using a custom SSL certificate.