R-OPE
OpenSSL
Standard TLS/crypto toolkit CLI for inspecting certificates, testing cipher and protocol support, and manually interacting with TLS services.
OVERVIEW
OpenSSL (openssl.org, github.com/openssl/openssl) is the reference TLS/SSL and general-purpose cryptography toolkit, and its `openssl` CLI binary is installed on nearly every Linux/macOS system by default. During a pentest it's used less for its library (which underpins countless other tools) and more as a direct-inspection utility: s_client opens a raw TLS connection to any host/port to show the negotiated protocol version, cipher suite, and full certificate chain, and x509 parses a certificate file to show its subject, issuer, validity window, and extensions.
Because s_client behaves like a raw socket once the TLS handshake completes, it also doubles as a manual client for line-based TLS protocols (SMTP, IMAP, and plain HTTP-over-TLS) when a purpose-built client isn't available or when you need to see exactly what's on the wire without a library's abstraction in the way.
USE CASES
Practical use cases
- 01
Pulling a service's full certificate chain to check expiry, issuer, SANs, and trust before reporting a TLS finding.
- 02
Testing which protocol versions and cipher suites a server accepts (SSLv3, TLS 1.0, weak ciphers).
- 03
Opening a raw TLS connection with s_client to manually issue commands to an SMTP/IMAP/HTTPS service.
- 04
Generating a CSR or self-signed certificate to test how an application validates client certificates.
QUICK START
Whenever a TLS service turns up during enumeration — to pull its certificate chain, check for weak protocols/ciphers, or open a raw connection when no other client fits.
- Confirm connecting to and probing the target TLS service is within the authorized scope.
- Use s_client to open a connection and view the negotiated protocol, cipher, and certificate chain.
- Use x509 to parse the retrieved certificate's fields (subject, issuer, validity, SANs) in detail.
- Repeat s_client with -tls1, -tls1_1, or specific -cipher values to map exactly what the server still accepts.
- Record protocol/cipher support and certificate details as evidence for the report.
openssl s_client -connect target.example.com:443 -servername target.example.comBEFORE YOU RUN IT
What to check before running it
s_client establishes a real TCP/TLS connection to the target — even read-only inspection is network activity against the service, so confirm it's within scope like any other connection.
CLI behavior and flag availability differ meaningfully between OpenSSL 1.1.1 and 3.x (and between OpenSSL and LibreSSL forks on some systems) — confirm the local version before assuming a flag exists.
Weak-cipher/protocol findings depend on server configuration that can change at any time — timestamp and re-verify results close to when the report is delivered.