SSL/TLS Configuration and Verification on Linux

Introduction

SSL/TLS is used to secure communication between a website and its visitors. When SSL/TLS is configured, the website can be accessed using HTTPS instead of HTTP.

On a Linux server, SSL/TLS configuration generally involves installing the required SSL certificate, configuring the web server, redirecting HTTP traffic to HTTPS, and verifying the certificate and TLS connection.

This guide explains some commonly used Linux commands to check SSL certificates, test HTTPS connectivity, and verify the web server configuration.

Prerequisites

Before working with SSL/TLS on a Linux server, make sure you have:

Root or sudo access to the server.
SSH access to the Linux server.
A working website and domain name.
Apache or Nginx installed.
An SSL/TLS certificate and private key.
Basic knowledge of Linux commands.

Implementation

Step 1: Check the Web Server

First, identify whether Apache or Nginx is running on the server.

For Apache:

systemctl status apache2

On CentOS/RHEL-based systems:

systemctl status httpd

For Nginx:

systemctl status nginx

These commands help verify whether the web server is running.

Step 2: Check Whether HTTPS Port 443 Is Listening

Use the following command to check whether the server is listening on the port 443:

ss -lntp | grep :443

You can also use:

netstat -lntp | grep :443

If HTTPS is configured correctly, port 443 should normally appear as a listening port.

Step 3: Test the HTTPS Connection Using curl

Use curl to check whether the website is accessible through HTTPS:

curl -I https://example.com

A successful response may look similar to the following:

HTTP/1.1 200 OK

You can also use:

curl -v https://example.com

The -v option displays detailed information about the HTTPS connection, including the TLS connection and certificate information.

Step 4: Check the SSL Certificate Using OpenSSL

The openssl command can be used to inspect the SSL/TLS certificate presented by the website.

Run:

openssl s_client -connect example.com:443

To display the certificate details:

openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -text

This displays information such as the following:

Certificate issuer.
Certificate subject.
Validity period.
Public key information.
Certificate extensions.

Step 5: Check the Certificate Expiry Date

To check when the certificate expires, use:

openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -dates

Example output:

notBefore=Jun  1 00:00:00 2026 GMT
notAfter=Aug 30 23:59:59 2026 GMT

The notAfter value indicates the certificate expiration date.

Step 6: Check the Certificate Subject

To verify the domain associated with the certificate:

openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -subject

This can help identify whether the certificate belongs to the expected domain.

Step 7: Check the Certificate Issuer

Use the following command to check which Certificate Authority issued the certificate:

openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -issuer

The output shows the certificate’s issuer.

Step 8: Check the TLS Version

To test a specific TLS version, you can use OpenSSL.

For TLS 1.2:

openssl s_client -connect example.com:443 -tls1_2

For TLS 1.3:

openssl s_client -connect example.com:443 -tls1_3

These commands can be used to verify whether the server supports the specified TLS version.

Step 9: Check HTTP to HTTPS Redirection

If HTTP traffic should redirect to HTTPS, run:

curl -I http://example.com

A correctly configured redirect may return:

HTTP/1.1 301 Moved Permanently
Location: https://example.com/

This confirms that HTTP requests are being redirected to HTTPS.

Step 10: Test the Website Certificate and Connection

The following command can be used for a quick HTTPS connection check:

curl -Iv https://example.com

It provides detailed information about the connection and helps identify common SSL/TLS problems.

Common SSL/TLS Commands

Purpose	Command
Check HTTPS port	`ss -lntp \| grep :443`
Test HTTPS	`curl -I https://example.com`
Detailed HTTPS test	`curl -v https://example.com`
Check the certificate.	`openssl s_client -connect example.com:443`
Check certificate dates	`openssl s_client -connect example.com:443 </dev/null 2>/dev/null \| openssl x509 -noout -dates`
Check certificate issuer	`openssl s_client -connect example.com:443 </dev/null 2>/dev/null \| openssl x509 -noout -issuer`
Check certificate subject	`openssl s_client -connect example.com:443 </dev/null 2>/dev/null \| openssl x509 -noout -subject`
Test TLS 1.2	`openssl s_client -connect example.com:443 -tls1_2`
Test TLS 1.3	`openssl s_client -connect example.com:443 -tls1_3`
Check HTTP redirect	`curl -I http://example.com`

Common SSL/TLS Issues

1. Certificate Expired

Check the certificate validity using:

openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -dates

If the notAfter date has passed, the certificate needs to be renewed.

2. HTTPS Port Not Listening

Check port 443:

ss -lntp | grep :443

If there is no output, check the web server’s SSL configuration and service status.

3. HTTP Not Redirecting to HTTPS

Test the HTTP response:

curl -I http://example.com

If there is no 301 or 302 redirect to HTTPS, check the web server’s HTTP-to-HTTPS redirect configuration.

4. Certificate Does Not Match the Domain

Check the certificate subject:

openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -subject

Verify that the certificate is issued for the domain being accessed.

Conclusion

SSL/TLS configuration on a Linux server involves more than installing a certificate. Administrators should also verify that HTTPS is listening on port 443, the certificate is valid, the domain matches the certificate, supported TLS versions are working, and HTTP traffic is correctly redirected to HTTPS.

Commands such as curl, openssl, ss, and systemctl can be used to troubleshoot and verify SSL/TLS configuration directly from the Linux server.

FAQs

1. How can I check whether HTTPS is working on a Linux server?

Use:

curl -I https://example.com

You can also check whether the port 443 is listening:

ss -lntp | grep :443

2. How can I check when an SSL certificate expires?

Run:

openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -dates

The notAfter value shows the certificate expiration date.

Talk to our experts

Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here.

Post Views: 4