Usually people use their browser or a dedicated website like ssltest to test a server certificate installation.
But you can do it directly with the openssl
command:
# openssl s_client -CApath /etc/ssl/certs/ -connect www.foobar.com:443
...
...
New, TLSv1/SSLv3, Cipher is AES256-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : AES256-SHA256
Session-ID: 9E01CD86FA9F1483AD505F17E34C0B9BF99F57BBF9B5E6A5F2946F8858A86807
Session-ID-ctx:
Master-Key: 8ED5443DCD5F6706A0DF5C0196E1B3AFBAAD3FB0B5B680EB212D4FC3F2BCC24209D0E241FBA746D85559CFA8539D99F4
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1474905181
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
The line Verify return code: 0
indicate a correct installation. Note that the -CApath
option tells openssl where to look for the CA certificates. On Debian the directory is /etc/ssl/certs/
.