ssl-check

What this skill does

Performs a comprehensive SSL/TLS inspection of the target host using openssl s_client and curl. Checks certificate expiry date, issuer, and SAN (Subject Alternative Name), verifies whether deprecated protocol versions are disabled (TLS 1.0/1.1), lists cipher suites, and validates the certificate chain.

When to use

• To quickly assess the security level of a server's TLS configuration
• To debug connection errors caused by certificate expiry or incorrect SAN
• During bug bounty or penetration testing to check for downgrade attack potential

Prerequisites

• openssl installed (included by default on most Linux/macOS systems)
• curl installed
• Network access to port 443 (or specified port) on the target host

Inputs

Variable	Description	Example
HOST	Target hostname	example.com
PORT	TLS port (default 443)	443

Workflow

Step 1: Collect certificate information

HOST="example.com"
PORT="443"

echo "=== Certificate Information ==="
echo | openssl s_client \
  -connect "${HOST}:${PORT}" \
  -servername "$HOST" \
  2>/dev/null | openssl x509 -noout \
  -subject -issuer -dates -fingerprint -ext subjectAltName

echo ""
echo "=== Days until certificate expiry ==="
EXPIRY=$(echo | openssl s_client \
  -connect "${HOST}:${PORT}" \
  -servername "$HOST" \
  2>/dev/null | openssl x509 -noout -enddate 2>/dev/null \
  | cut -d= -f2)

if [ -n "$EXPIRY" ]; then
  EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$EXPIRY" +%s)
  NOW_EPOCH=$(date +%s)
  DAYS_LEFT=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))
  if [ "$DAYS_LEFT" -lt 30 ]; then
    echo "[WARNING] Certificate expiring soon: ${DAYS_LEFT} days remaining (expires: $EXPIRY)"
  else
    echo "[OK] Certificate valid: ${DAYS_LEFT} days remaining (expires: $EXPIRY)"
  fi
fi

Step 2: Test protocol version support

echo ""
echo "=== Protocol Support ==="

test_protocol() {
  local proto="$1"
  local flag="$2"
  result=$(echo | openssl s_client \
    -connect "${HOST}:${PORT}" \
    -servername "$HOST" \
    "$flag" 2>&1)
  if echo "$result" | grep -q "Cipher is"; then
    echo "[ENABLED]  $proto  <- active"
  else
    echo "[DISABLED] $proto"
  fi
}

test_protocol "TLS 1.0" "-tls1"
test_protocol "TLS 1.1" "-tls1_1"
test_protocol "TLS 1.2" "-tls1_2"
test_protocol "TLS 1.3" "-tls1_3"

echo ""
echo "Note: TLS 1.0 and 1.1 should show [DISABLED] for a secure configuration."