SMTP TLS verification with OpenSSL

Choose the endpoint type

Use the hostname specified by the service owner and a current OpenSSL client with an appropriate trusted CA store. STARTTLS upgrades an SMTP connection. Implicit TLS begins encryption immediately. Select the method configured for the actual endpoint, rather than guessing from a failed attempt.

Run the appropriate command

read -r -p "Actual SMTP certificate hostname: " smtp_host
read -r -p "SMTP port: " smtp_port
openssl s_client -starttls smtp -connect "$smtp_host:$smtp_port" \
  -servername "$smtp_host" -verify_hostname "$smtp_host" \
  -verify_return_error -showcerts </dev/null

read -r -p "Actual SMTP certificate hostname: " smtp_host
read -r -p "SMTP port: " smtp_port
openssl s_client -connect "$smtp_host:$smtp_port" \
  -servername "$smtp_host" -verify_hostname "$smtp_host" \
  -verify_return_error -showcerts </dev/null

These commands connect and inspect the TLS session; they do not submit a message. The hostname is used for SNI and certificate identity verification. -verify_return_error makes verification errors terminate the handshake instead of merely being printed.

Read the result

1. Check whether negotiation completed and whether certificate verification succeeded.
2. Inspect the leaf certificate identity, validity dates and presented chain. A missing local trust store can also cause verification errors.
3. Record the endpoint, port, client version and UTC time with the failure. Compare with the service’s documented certificate and chain configuration.
4. After repair, repeat the same check from the relevant network path.

Inspect your local version

openssl version -a

If your client does not support an option, consult the matching OpenSSL manual and update through your normal package-management process.

Sources

• OpenSSL s_client reference