About the TLS/SSL Cheat Sheet
Most day-to-day TLS work is inspection: what certificate is a host serving, what chain came with it, when does it expire, and which protocol versions and ciphers will it accept. Being able to answer those four from the command line resolves most certificate incidents quickly.
The distinction worth being precise about is between the certificate and the chain. A certificate can be entirely valid while the server fails to send the intermediate that links it to a trusted root, and the resulting failure is intermittent by client — browsers often recover by fetching the missing intermediate, while command-line tools and language runtimes do not.
Protocol versions have moved. TLS 1.0 and 1.1 are deprecated and disabled by default in current clients, 1.2 remains the compatibility floor, and 1.3 removes the older cipher negotiation entirely along with most of the ways to configure it badly.
Frequently asked questions
How do I check what certificate a server is actually sending?
Connect with openssl s_client, passing the server name so SNI selects the right certificate, and inspect what comes back. Look at the returned chain, not just the leaf — the number of certificates tells you immediately whether the intermediate is being sent. Checking the certificate file on disk does not tell you what the server serves.
What is the difference between PEM, DER, PKCS#12, and JKS?
PEM is base64 text with header lines and is what most Unix software expects. DER is the same structure in binary. PKCS#12 bundles a certificate, its chain, and the private key in one password-protected file, and is what Windows and many appliances want. JKS is the older Java format, largely superseded by PKCS#12. Conversion between them is a single openssl or keytool command.
Why does my certificate work in the browser but not in curl?
Nearly always an incomplete chain. Browsers can fetch a missing intermediate using the authority information access extension and often cache intermediates from other sites; curl and most language HTTP clients will not. If the browser succeeds and everything else fails, add the intermediate to the server's chain file.
How do I verify that a private key matches a certificate?
Compare the modulus of the key with the modulus of the certificate — if the hashes match, they belong together. This is the first check when a server refuses to start after a certificate renewal, because pairing a new certificate with the old key is one of the most common renewal mistakes.
What should I do about certificate expiry?
Automate renewal and alert on the remaining days independently of the automation. ACME clients handle issuance and renewal well, but the failure mode is silent — a renewal hook that stopped working is invisible until the certificate expires. Alert well before expiry, and monitor the certificate the server actually serves rather than the file on disk.
Need this managed for you, not just automated?
We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.