Как проверить SSL-сертификат для почтового домена?
Чтобы проверить сертификат, выполните команду:
openssl s_client -showcerts -servername mail.domain.tld -connect IP:port
Пояснения к команде
Ответ на команду будет содержать информацию о сертификате, который используется при подключении через почтовый клиент.
Пример ответа
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = example.com
verify return:1
---
Certificate chain
0 s:/CN=example.com
i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
-----BEGIN CERTIFICATE-----
MIIFaDCCBFCgAwIBAgISA0ri6wJIDhR2lmwzQyxxzhugMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODExMjkxMjE3MTNaFw0x
...
Y5NaMKzSyuaL6rtAC9vS5ZaD6XGDzfIs/fqsJ1whNC+/bpW6QKiJS63G71dTiFx5
WE0CfzScmJkK6oUo81mMZmDdW/MqUKbh3RzPI0U5luhlFHU8l8zknyRj1SAC5iAn
IMmQygKwi/GszV6QgJ4t1D500T61EYYP2gBns33ntPgtSrNEWH8QyIG5FQE=
-----END CERTIFICATE-----
1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
...
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=example.com
issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3076 bytes and written 330 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: CC153897D816CAD36443FB3E3769E9B30A456B099776D99B1B83760673B329DC
Session-ID-ctx:
Master-Key: 597BF1E0D91770E6A64ACF5866166D3CC8FEB545FE23E00B89069FCF77B596C71160A5288411F3FC7CB16ADD50DABB5F
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1543628188
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
---
220 cloud.domain.com ESMTP Exim 4.90_1 Sat, 01 Dec 2018 04:36:29 +0300