Checking TLS certificates in use

In the efforts to secure communications over TCP/IP, we often have to deal with the certificates that are the keys to the process. Checking that the correct and correctly configured certificate (or cert for short) is the one running, is an essential troubleshooting/validation step. 

The best way where possible is to check the running cert on the running service. Especially that the correct cert that is being used.  Typically, we'd be looking at the dates that it is valid, the name (subject or common name), and the Subject Alternative Name (SAN)

For Web interfaces, a browser is the ultimate testing tool, with Firefox being the (currently in 2026) most consistent to work with, but the general concepts are the same with the others even if done differently.  If there is a problem stopping you from getting to the page, you just have to pause there, because the details are already available. 

Firefox:

For some issues, it will offer you to look at the cert below the scary sounding warning, if so, that is the easy option. Otherwise, if you've accepted the risk already or it is a good cert, you should see a little shield in front of the URL. The shield shows with a checkmark in it for good, or an Exclamation mark (Not Secure) if not.

Click on that shield, and in top right of that sub-window click on "Connection {not} secure" as the case may be.  Select "More site Information" at the bottom, and then View Certificate to see a page with all the details that you can 'print' for your records (usually to pdf or such)

Chrome (and related):

If there is a cert issue stopping you with the dreaded "Your connection is not private", click on the red "Not secure" in front of the URL, where you will see the option for Certificate details to click on, and then look at. The first tab has some useful basics, but often we need to look at the details tab to expand the fields you want to look at, such as to find the Extension of 'Certificate Subject Alternative Name'. The Export option saves an actual public key that can be looked at with tools such as openssl or KeyStore Explorer that we'll discuss further down.

If the cert is accepted as a secure one, click on the slider 'tune' button in front of the URL, click on "Connection is secure", click on the "Certificate is Valid" to see the Certificate details described above. 

Other options:

If you have to do this regularly, there is a GUI tool called  https://keystore-explorer.org/  KeyStore Explorer that works with most GUI. 

For our purposes, select 'Examine', 'Examine TSL/SSL', enter the target host and port, 

With the next page not directly showing the SAN, that is one of the Extensions, where if the cert has a SAN, you see the Extension, and clicking on it shows the value(s)

Linux Systems:

If you are on a Linux system (or can shell into), we can use https://en.wikipedia.org/wiki/OpenSSL openssl from the command line without an install. Other operating systems typically need an install.

 # openssl s_client -showcerts -connect {serverIP|FQDN}:443 |openssl x509 -noout -text |less

 # openssl s_client -showcerts -connect google.com:443 |openssl x509 -noout -text |less

While the default secured web traffic set to port 443, others can readily be used and often are used for administrative interfaces.  Also, there are many other services that use TLS to secure them, and this is where the openssl command and KeyStore Explorer are our most available options to look at them. 

Direct file examination:

 #  openssl x509 -in server.crt -text -noout

or with KeyStore Explorer, 'Examine' from the menu, 'Examine File', browse to the file to be examined.

There are other options and ways, this is just the primer as I found many who need these steps don't know them off of hand, so this is an effort to make it easy. 

Moderation of groups/forums

Keeping a group/forum civil and on track can be quite a challenge.

Moderators have a range of challenges dealing with keeping a group on a track:

• Posters who don't understand what a group/forum is about (its core focus) and post stuff way outside that focus.  Clutter. 
• Bad actors: those spammers/scammers trying to pull attention away to other things that have nothing to do with the group/forum, even if they make their post look superficially like it belongs. I've often seen these go to incompatible or even competing products/services, and beyond to straight out scams and malware. These bad actors are hoping that readers are careless, thinking that those links have been vetted already, and that all vetting is perfect.
• Posters who have a real question or concern, but provide insufficient information about it, assuming the other participants are mind readers. There are often several ways the issue or concern could be taken, so others have to ask clarifying questions back at you to better understand, and as part of vetting your post.  
• Posters who don't speak the same language/culture as the group default/majority.

Tips: 

• If posts get through without being held for review, they have NOT been vetted and can't be trusted like you might others you already know in the group. Look who posted it, and even there could be a masqueraded or compromised account. 
• Even if the content of a group/forum looks all good, and you see active moderation happening, bad stuff still sneaks in and can take some time to be cleared out. Making sure you report such content helps the moderators see it as they aren't in the group 24/7 (most are unpaid volunteers!).
• If a group/forum has lots of out of scope and/or junk content, that is probably a group without active moderation. If it is an area that you'd like to be cleaner and be a part of, try to moderate it by flagging bad content as moderators can't see it all. You might even be invited to help moderate, or you can even offer if there is even someone there who could grant you those technical permissions. 
• If your post is answered with questions, they are usually honest, and jumping back at them makes you appear more like the spammer/scammers. Bad actor posters will often use bullying approach to push their suspicious content through, inviting the wrath of the BanHammer (a range of control moderators have to pause or block bad actors).

Summary:
Groups/forums can be useful and fun, but as with any other human activity, we can have misunderstandings among honest caring people, and we can have bad actors trying to mess things up one way or another. So be ready for the occasional such misunderstanding, because none of us are perfect, whether flesh or artificial.  Being nice is just the least friction path forward, especially for those of us trying to keep the arena of conversation nice.