You can verify HTTPS port availability and certificate details using the
curl command with specific flags. This method works across Linux, Windows, and macOS without needing
wget,
nc, or bare Alpine system utilities. The approach provides immediate feedback on connection success, TLS version, and server response codes.
Basic Connectivity Check
The most straightforward way to check if an HTTPS endpoint is reachable is to use
curl with the
-I flag. This sends a HEAD request, which retrieves only the HTTP headers from the server. It is lightweight and fast, making it ideal for quick diagnostics.
curl -I https://example.com
If the connection succeeds, you will see a status line starting with
HTTP/1.1 200 OK or similar. A failure might result in a timeout error or a connection refused message. This confirms that the port (usually 443) is open and responding to TCP connections.
Verifying SSL/TLS Certificates
Checking connectivity is not enough; you must also ensure the SSL handshake completes successfully. Use the
--verbose flag (
-v) to see the detailed exchange between your client and the server. This reveals whether the certificate is valid, expired, or mismatched.
curl -v https://example.com
Look for lines containing
SSL connection using or
Certificate verification. If you see
SSL: certificate problem, the certificate chain may be broken or self-signed. You can suppress this error temporarily by adding
-k or
--insecure, but do not use this in production environments.
Inspecting Certificate Details
To extract specific information about the certificate without downloading the page content, combine
-I with
--verbose. This shows the issuer, validity dates, and subject alternative names.
curl -I --verbose https://example.com 2>&1 | grep -i "subject\|issuer\|expire"
This pipeline filters the verbose output to show only relevant certificate fields. It helps identify if a certificate is nearing expiration or if the domain name does not match the certificate subject.
Testing Specific Ports and Protocols
Sometimes services run on non-standard ports. You can specify the port directly in the URL or use the
--connect-timeout option to limit how long
curl waits for a response.
curl -I --connect-timeout 5 https://example.com:8443
This command attempts to connect to port 8443 with a five-second timeout. If the port is closed or filtered by a firewall, you will receive a connection timeout error. Adjust the timeout value based on your network conditions.
Handling Redirects and Final URLs
Websites often redirect HTTP to HTTPS or change domains. Use the
-L flag to follow redirects automatically. This ensures you are testing the final destination rather than an intermediate redirect page.
curl -I -L https://example.com
Without
-L, you might see a
301 Moved Permanently response, which could be mistaken for a failure. Following redirects gives you the actual status of the target resource.
Comparing Alternatives
While
curl is versatile, other tools exist.
wget is simpler for downloads but lacks some diagnostic flags.
nc (netcat) can test raw TCP connectivity but cannot handle HTTPS handshakes. For pure port checking,
telnet or
ssh can be used, but they do not validate SSL certificates.
For more complex API testing, consider using
Postman: Sending POST requests. Postman provides a graphical interface and detailed logging for HTTP/HTTPS interactions. It is particularly useful when you need to inspect request bodies and headers visually.
Common Errors and Fixes
If
curl fails, check your DNS resolution first. Use
nslookup or
dig to verify the domain resolves correctly. Next, check if your firewall allows outbound traffic on port 443. Finally, ensure your system's CA certificates are up to date. On Linux, update the
ca-certificates package. On Windows, ensure root certificates are installed via Windows Update.
On macOS, you may need to install
ca-certificates via Homebrew if using a custom OpenSSL build. Always verify the environment before assuming the server is down.
Frequently Asked Questions
How do I check if a specific port is open?
Use
curl -I http://hostname:port to test HTTP ports. For HTTPS, replace
http with
https. If the connection times out, the port is likely blocked or closed.
Why does curl fail with certificate errors?
This happens when the server's certificate is self-signed, expired, or issued by an unrecognized authority. Add
-k to bypass verification for testing, but fix the certificate in production.
Can I use curl to check SSL expiration dates?
Yes, use
curl -v https://example.com 2>&1 | grep "expire". This extracts the expiration date from the verbose output. You can parse this date programmatically for monitoring scripts.
What is the difference between wget and curl for port checking?
wget is designed for file downloads and has limited diagnostic options.
curl offers extensive flags for debugging connections, certificates, and headers. Use
curl for troubleshooting and
wget for bulk downloads.
How do I test HTTPS behind a proxy?
Set the
https_proxy environment variable before running
curl. For example, export
https_proxy=http://proxy:8080. Then run your
curl command as usual. The proxy will handle the HTTPS tunneling.