Beyond a full SSL scan tool, OpenSSL's command line lets you directly test whether a server accepts a specific TLS version — useful for confirming a hardening change actually took effect.
openssl s_client -connect yourdomain.com:443 -tls1_2
openssl s_client -connect yourdomain.com:443 -tls1_1A successful handshake output (showing certificate details and a completed connection) means that specific protocol version is still accepted; a handshake failure means it's correctly disabled. Testing each version individually this way confirms your server configuration matches what you intended, rather than relying solely on a third-party scan tool's summary.
What to do if a specific protocol version test hangs rather than failing quickly
A hanging connection attempt, rather than a clean failure, sometimes indicates a firewall silently dropping the connection rather than the server actively rejecting the specific protocol — adding a timeout flag to your OpenSSL command distinguishes this network-level issue from a genuine protocol-level rejection.
How to test for a complete list of supported cipher suites systematically
An SSL scan tool provides a more complete, systematically tested list of every cipher suite a server accepts in one report, generally faster and more thorough than manually testing individual cipher suites one at a time through repeated OpenSSL commands.
What a complete testing script covering every protocol version looks like
Looping the OpenSSL connection test across each protocol version flag (-ssl3, -tls1, -tls1_1, -tls1_2, -tls1_3) in sequence, recording which succeed and which fail, builds a complete picture of exactly which versions a server currently accepts without needing a separate, external scanning tool.
How to test for support of a specific named cipher suite directly
Adding the -cipher flag with a specific cipher suite name to your OpenSSL connection command tests whether a server accepts that exact cipher, useful for confirming a specific suite is or isn't available without needing to interpret a full scan report's complete list.
Why command-line testing gives more precise, scriptable results than a web-based scanner for automation purposes
Command-line OpenSSL tests can be scripted and integrated directly into automated monitoring or CI/CD pipelines, producing machine-parseable output, while a web-based scanner is designed for human-readable manual review and isn't well suited to automated, repeated programmatic checking.
What to do if OpenSSL itself doesn't support testing a specific older or newer protocol version
Very old OpenSSL versions may lack support for testing newer protocols like TLS 1.3, while some Linux distributions' OpenSSL builds deliberately omit support for testing deprecated protocols like SSL 2.0/3.0 for security reasons — checking your installed OpenSSL version's specific capabilities, or using a dedicated online scan tool as an alternative, resolves this limitation.
How to interpret a 'wrong version number' error during protocol testing
A wrong version number error typically means you attempted a TLS handshake against a port or service not actually running TLS at all, or running a protocol version so different from what was requested that the initial handshake bytes weren't recognized — double-checking you're testing the correct port and that the service genuinely speaks TLS resolves most instances of this specific error.
A closing note on command-line testing as a complement to, not replacement for, automated scanning
Manual OpenSSL testing is best used for quick, specific, ad-hoc checks and genuine understanding of what's happening at the protocol level — for comprehensive, ongoing coverage, pairing it with a scheduled SSL scan tool check remains the more complete overall practice.
A final practical tip for building your own reference toolkit
Building a small library of the specific OpenSSL commands you use most often into a personal reference document or shell script collection turns occasional, easily-forgotten syntax into a readily available, reusable toolkit for future troubleshooting.