I'm writing a script to check the SSL expiry dates of all my domains.

This works for my normal sites:

echo | openssl s_client -connect $domain:443 2> /dev/null | openssl x509 -noout -enddate

However it does not work for AWS CloudFront. I have uploaded my own certificate to CF and am using a CNAME.

The output is:

15336:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Does anyone know why?

I have already tried -ssl2 and -no_ssl3 options.

  • 5
    Try to use SNI, i.e. use the -servername hostname option of openssl s_client. Jun 2, 2016 at 6:49
  • Hi Steffen that works! Thank you! If you want to copy my answer below Ill delete my answer and give you the rep. Jun 2, 2016 at 7:00

1 Answer 1


Adding -servername $domain fixed it:

openssl s_client -connect $domain:443 -servername $domain 2> /dev/null < /dev/null | openssl x509 -noout -enddate

Many thanks to Steffen Ullrich for the comment on the Q.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.