Skip to content
Browse

/flags/openssl/openssl-s-client-servername

openssl s_client -servername: test TLS with SNI

verified onenvironmentlocal · windows 10.0.26200 arm64 · GNU bash 5.3.15 (Git Bash) · OpenSSL 3.5.7 9 Jun 2026 (Library: OpenSSL 3.5.7 9 Jun 2026)updated 2026-10-20
tool
OpenSSL
command
openssl s_client
flag
-servername
default
the host name from -connect (OpenSSL 1.1.1 and later)

-servername sets the TLS Server Name Indication (SNI) that openssl s_client sends, which tells a server hosting several sites which certificate to present. Since OpenSSL 1.1.1 s_client sends the -connect host name as SNI by default; pass -servername explicitly when you connect to an IP address or test a different name.

Quick check with -brief

bash
openssl s_client -connect www.openssl.org:443 -servername www.openssl.org -brief </dev/null 2>&1 | grep -E '^(Protocol version|Peer certificate|Verification)'

Output

Protocol version: TLSv1.3
Peer certificate: CN=openssl.org
Verification: OK

</dev/null closes the connection right after the handshake instead of waiting for input.

Useful companions

OptionWhat it adds
-briefone-screen summary: protocol, cipher, peer certificate, verification result
-showcertsprint every certificate the server sends (check intermediates)
-noservernamesend no SNI at all (see the server default certificate)
-tls1_2 / -tls1_3force a protocol version
-alpn h2,http/1.1offer ALPN protocols
-CAfile ca.pemverify against a private CA

Read the certificate dates

bash
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -dates

If this prints a certificate for another host, the server's default certificate was returned: SNI is missing or does not match any configured site.

Sources

Related pages

errors · opensslunable to get local issuer certificate (OpenSSL verify error 20)OpenSSL error 20, unable to get local issuer certificate, means the issuing CA is missing from the trust store or the chain. Add the CA or intermediate.glossary · opensslWhat is a certificate chain (chain of trust)?A certificate chain links a server leaf certificate through intermediate CAs to a trusted root. Clients verify each signature up to a root in their trust store.cheat sheets · opensslOpenSSL cheat sheet: keys, CSRs, certificates and TLS checksOpenSSL cheat sheet: generate keys and CSRs, inspect certificates, check that key and certificate match, convert PEM, DER and PFX, verify chains and test TLS.