# How to Test SSL/TLS Certificate Configuration Using Command-Line Tools from The Book of Secret Knowledge > Master SSL/TLS certificate configuration testing with command-line tools like openssl and testssl.sh. Verify chains, ciphers, and protocols securely. - Repository: [Michał Ży/the-book-of-secret-knowledge](https://github.com/trimstray/the-book-of-secret-knowledge) - Tags: how-to-guide - Published: 2026-02-24 --- **You can test SSL/TLS certificate configuration using `openssl`, `sslscan`, [`testssl.sh`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/testssl.sh), and `sslyze` to verify certificate chains, enumerate supported cipher suites, and detect protocol vulnerabilities directly from the terminal.** Testing SSL/TLS certificate configuration is essential for maintaining secure web services and preventing protocol downgrade attacks. The repository `trimstray/the-book-of-secret-knowledge` curates a comprehensive collection of command-line utilities specifically designed for deep TLS inspection and certificate validation. This guide demonstrates how to leverage these tools to audit certificate expiry, chain integrity, and cryptographic compliance. ## Essential SSL/TLS Testing Tools in the Repository The **SSL** section of the repository, located within the *Web Tools → SSL/Security* chapter, catalogs utilities for comprehensive certificate analysis. Each tool serves a specific function in the testing workflow. ### OpenSSL **OpenSSL** provides the foundational `s_client` utility for manual TLS handshake inspection and certificate extraction. According to the source code analysis, this tool is referenced at [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 260](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L260). ### SSLScan **SSLScan** rapidly enumerates supported protocols, cipher suites, and certificate details without requiring complex configuration. The repository lists this tool at [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 264](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L264). ### TestSSL.sh **TestSSL.sh** offers a comprehensive audit suite that checks protocol support, weak ciphers, certificate expiration, HSTS headers, and OCSP stapling. This full-featured scanner appears at [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 266](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L266). ### SSLyze **SSLyze** is a Python-based scanner capable of probing TLS parameters including client-authentication requirements and certificate chain validation. The repository references this tool at [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 263](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L263). ### CipherScan **CipherScan** provides a lightweight method to list server-offered cipher suites, useful for quick sanity checks during configuration changes. This utility is also cataloged at [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 266](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L266). ## Four-Phase Workflow to Test SSL/TLS Certificate Configuration Testing certificate configurations requires a systematic approach combining lightweight probes and comprehensive scanners. The following workflow aligns with the tool categorization in `trimstray/the-book-of-secret-knowledge`. ### Discovery Phase Begin with lightweight probes to confirm service reachability and retrieve the presented certificate chain. Use **OpenSSL** to establish a connection and dump certificate details. ### Capability Enumeration Execute comprehensive scanners to list supported protocol versions, cipher suites, and TLS extensions such as ALPN and OCSP Stapling. **SSLScan** and **TestSSL.sh** excel at this stage, providing detailed reports on server capabilities. ### Compliance and Hardening Validation Apply focused scripts to verify security best practices, including disabled TLS 1.0/1.1 support, enforced forward secrecy, and strong cipher suite selection. **CipherScan** and specific **TestSSL.sh** modules identify weak configurations that violate modern security standards. ### Certificate Chain Verification Validate expiry dates, hostname matching, and proper chain building using **OpenSSL** utilities. This phase ensures that certificates are not expired, correctly signed by trusted authorities, and properly configured for the target domain. ## Command-Line Examples for Certificate Testing The following practical examples demonstrate how to execute SSL/TLS tests using the tools cataloged in the repository. Each command targets `example.com:443` and can be adapted for your specific domain. ### Basic Connectivity and Certificate Dump Use **OpenSSL** to connect and display the full certificate chain: ```bash echo | openssl s_client -connect example.com:443 -showcerts ``` *Reference:* [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 260](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L260) ### Quick Cipher and Protocol Enumeration Use **SSLScan** to list all supported TLS versions and cipher suites: ```bash sslscan example.com:443 ``` *Reference:* [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 264](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L264) ### Comprehensive Security Audit Use **TestSSL.sh** to perform a deep scan including protocol support, cipher strength, certificate expiration, HSTS, and more: ```bash testssl.sh --slow example.com:443 ``` *Reference:* [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 266](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L266) ### Python-Based TLS Scanning Use **SSLyze** to probe TLS parameters including client-authentication requirements: ```bash # Install via pip if not present pip install sslyze # Perform a comprehensive scan sslyze --regular example.com:443 ``` *Reference:* [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 263](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L263) ### Lightweight Cipher Suite Listing Use **CipherScan** for a simple report of server-offered cipher suites: ```bash cipherscan example.com:443 ``` *Reference:* [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 266](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L266) ### Verify Certificate Expiration Use **OpenSSL** to check if a certificate has expired or will expire within a specific timeframe: ```bash # Check how many seconds until the cert expires (0 = already expired) openssl x509 -noout -checkend 0 -in <(openssl s_client -connect example.com:443 -servername example.com /dev/null | openssl x509) ``` *Reference:* [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 260](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L260) ## Summary Testing SSL/TLS certificate configuration requires a systematic approach combining lightweight probes and comprehensive scanners. The `trimstray/the-book-of-secret-knowledge` repository curates essential command-line tools including **OpenSSL**, **SSLScan**, **TestSSL.sh**, **SSLyze**, and **CipherScan** to validate certificate chains, enumerate cipher suites, and verify protocol compliance. By following a four-phase workflow—Discovery, Capability Enumeration, Compliance Validation, and Certificate Verification—you can automate security audits and ensure your TLS implementations meet modern hardening standards. ## Frequently Asked Questions ### What is the fastest way to check if a TLS certificate is expired? Use the `openssl x509 -checkend` command to verify certificate validity in seconds. This method connects to the target service, retrieves the certificate, and returns an exit code indicating whether the certificate has expired or will expire within the specified threshold, making it ideal for automated monitoring scripts. ### Which tool from The Book of Secret Knowledge provides the most comprehensive TLS audit? **TestSSL.sh** offers the most thorough analysis, checking protocol support, cipher strength, certificate expiration, HSTS headers, OCSP stapling, and various vulnerabilities. It is referenced at [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 266](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L266) and requires no installation beyond downloading the script, making it accessible for immediate use on any Unix-like system. ### Can I test SSL/TLS configurations without installing specialized software? Yes, **OpenSSL** is typically pre-installed on most Linux distributions and macOS systems. The `openssl s_client` command provides sufficient functionality to test connectivity, view certificate chains, and verify cipher support without additional packages, as documented at [[`README.md`](https://github.com/trimstray/the-book-of-secret-knowledge/blob/main/README.md) line 260](https://github.com/trimstray/the-book-of-secret-knowledge/blob/master/README.md#L260). ### How do I automate SSL/TLS testing in CI/CD pipelines? Use **SSLyze** or **TestSSL.sh** in automated scripts. **SSLyze** provides structured JSON output suitable for programmatic parsing, while **TestSSL.sh** supports batch scanning of multiple hosts. Both tools exit with non-zero status codes when critical vulnerabilities are detected, making them ideal for integration into continuous integration workflows that require automated security gates.