TLS Handshake and Certificates

Run TLS in production: handshake basics, cert chains, expiry prevention, and practical debugging with openssl/curl.

On this page

Production TLS: What Breaks

Cert expiry, wrong chain, wrong hostname (SNI), old cipher/protocol mismatch
Clock skew on servers/clients
Proxy terminates TLS but backend expects TLS (or vice versa)

Quick TLS Debug with curl

curl -sv https://example.com/health --max-time 5 || true
curl -sv --resolve example.com:443:<IP> https://example.com/health --max-time 5 || true

Inspect Certificate Chain

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Expiry Prevention Runbook

Alert at T-30, T-14, T-7 days (and daily at T-3).
Automate renewal + deploy + validation (staging first).
Validate chain and hostname from outside the cluster/VPC too.

Failure Modes

Intermediate missing: some clients fail, others succeed (partial outage).
SNI mismatch: works by IP but fails by hostname.
Clock skew: 'not yet valid' / 'expired' even with correct cert.

Checklist

date -u
curl -sv https://example.com --max-time 5 || true
openssl s_client -connect example.com:443 -servername example.com </dev/null | grep -E 'Verify return code|subject=|issuer=|notAfter'

← DNS in Production: TTL, caching, outages

Timeouts and Retries Across Layers →