Inspect a Website Certificate Through an HTTP Proxy with OpenSSL
Use OpenSSL s_client through an HTTP CONNECT proxy while keeping the destination name, SNI, and certificate verification aligned.
Use an installed OpenSSL s_client that supports -proxy. For an authorized HTTP CONNECT endpoint:
openssl s_client -proxy proxy.example:3128 -connect example.com:443 -servername example.com -verify_hostname example.com -verify_return_error -showcertsReplace the proxy address and use the intended destination name consistently. For a public-destination test through a proxy you may choose, select an HTTP candidate from the HTTP proxy list. -connect selects the target, -servername sends SNI for its TLS virtual host, and -verify_hostname checks the identity. SNI alone is not hostname verification. Check the manual for the installed release when adapting options.
-showcerts displays what the server sent, not a declaration that the chain is trusted. -verify_return_error makes verification errors terminate the handshake; the diagnostic client can otherwise continue after errors. Use approved CA material for a private service rather than trust an arbitrary downloaded certificate.
| Result | Stage |
|---|---|
| 407 | Proxy authentication before destination TLS. |
| Denied CONNECT target | Proxy destination policy. |
| Certificate received and verification attempted | The destination TLS exchange through the accepted tunnel. |
With OpenSSL 3.x and a Basic-authenticating HTTP proxy, use the s_client proxy-account options while retaining destination verification.
A SOCKS-only endpoint does not provide the HTTP proxy interface this command uses. With authorized TLS interception, the displayed certificate may be issued by that intermediary. Compare its issuer and intended trust arrangement before attributing a difference to a broken website.