🧑🏻💻 Introduction
When you go through DNS, you can be misled by:
- caching
- load balancers / CDNs
- name-resolution mistakes
This guide standardizes all commands to IP-direct access + correct SNI so you can isolate the real cause quickly.
🧑🏻💻 Prerequisite Variables
DOMAIN=example.com
IP=1.2.3.4
🧑🏻💻 Overall Flow
① Check reachability with curl (IP direct)
↓
② Read certificate verification result
↓
③ Get raw TLS data with openssl
↓
④ Check certificate expiration
↓
⑤ Verify SAN
↓
⑥ Check intermediate certificate
↓
⑦ Verify TLS versions
🧑🏻💻 ① HTTP Reachability (IP direct + SNI)
curl -v https://$DOMAIN \
--resolve $DOMAIN:443:$IP \
-o /dev/null
OK
* Connected to example.com (1.2.3.4) port 443
* SSL certificate verify ok.
< HTTP/1.1 200 OK
Failure
Connection refused
- nginx / apache not running
- closed port
- firewall
🧑🏻💻 ③ Raw TLS Layer Information
openssl s_client \
-connect $IP:443 \
-servername $DOMAIN
OK
CONNECTED(00000003)
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Verify return code: 0 (ok)
🧑🏻💻 ④ Certificate Expiration
openssl s_client \
-connect $IP:443 \
-servername $DOMAIN 2>/dev/null \
| openssl x509 -noout -dates
notAfter=May 2 23:59:59 2026 GMT
🧑🏻💻 ⑤ SAN (Domain Match)
openssl s_client \
-connect $IP:443 \
-servername $DOMAIN \
| openssl x509 -noout -ext subjectAltName
DNS:example.com
DNS:www.example.com
🧑🏻💻 ⑥ Missing Intermediate Certificate Check
openssl s_client \
-connect $IP:443 \
-servername $DOMAIN \
-showcerts
OK
Certificate chain
0 s:CN = example.com
1 s:C = US, O = Let's Encrypt, CN = R3
Missing
Certificate chain
0 s:CN = example.com
→ fullchain.pem not configured
🧑🏻💻 ⑦ TLS Version Restrictions
TLS 1.2
curl --tlsv1.2 -v https://$DOMAIN \
--resolve $DOMAIN:443:$IP \
-o /dev/null
TLS 1.3
curl --tlsv1.3 -v https://$DOMAIN \
--resolve $DOMAIN:443:$IP \
-o /dev/null
unsupported protocol
→ ssl_protocols misconfiguration
🧑🏻💻 ⑧ Detect SNI Misconfiguration (intentionally omit it)
openssl s_client -connect $IP:443
subject=CN = default.example.net
→ default certificate returned
→ virtual host configuration issue
🧑🏻💻 Copy-Paste 5-Minute Diagnosis Set
DOMAIN=example.com
IP=1.2.3.4
curl -v https://$IP \
-H "Host: $DOMAIN"\
-o /dev/null
openssl s_client -connect $IP:443 \
-servername $DOMAIN -brief
openssl s_client -connect $IP:443 \
-servername $DOMAIN 2>/dev/null \
| openssl x509 -noout -dates
openssl s_client -connect $IP:443 \
-servername $DOMAIN \
| openssl x509 -noout -ext subjectAltName
🧑🏻💻 Root-Cause Shortcut Map
Cannot connect even with IP direct
→ server or firewall
Verify error
→ intermediate certificate
Expired
→ certificate renewal missed
SAN mismatch
→ wrong certificate selected
Different cert without SNI
→ virtual host configuration
Only one of TLS1.2 / 1.3 fails
→ protocol restriction
🧑🏻💻 Summary
By eliminating DNS and fixing:
- IP-direct access
- correct SNI
your TLS troubleshooting speed improves dramatically.
This workflow is ready to copy-paste in real incidents.
👉 openssl-s_client - OpenSSL Documentation
👉 curl - SSL CA Certificates
