How to use telnet to test ssl/https websites

Matthew Nuzum —  — 13 Comments

OK, here’s the problem… you want to test a website by sending custom headers, but the website uses https. Normally you’d just telnet to port 80 like so:

telnet www.somesite 80
GET /index.html HTTP/1.1
Host: www.somesite

(Note you need to press enter twice at the end)

This would be a valid HTTP GET request and you’d see the server’s response headers and response data. But with an SSL website this won’t work at all. What do you do?

Use openssl of course. The openssl s_client program works perfectly here:

openssl s_client -connect www.somesite:443
[watch the ssl certificate details scroll by]
GET /index.html HTTP/1.1
Host: www.somesite

(again you need to press enter twice)

VOILA! But one gotcha… when using telnet the webserver would patiently wait for me to type out the request completely. s_client does NOT. So type out your request in a text editor and have it ready to paste in right after the ssl cert details scroll by.

I’ve only tried it with Ubuntu Linux but it should work on any Linux and Mac OS if you have openssl installed. There is a version for Windows too.

Thanks Ng, one of the phenomenal Canonical sysadmins for this tip. Also, Steve Langasek, the Ubuntu release manager suggests gnutls. It works similarly:

gnutls www.somesite

No need to specify a port number or use any command line options. Note that like s_client you need to be ready to paste your request in. apt-get install gnutls-bin will take care of you here.

Do you want to use telnet to test SPDY or HTTP/2 websites? Here’s a tool to help with that.

If it helped, please share!Tweet about this on TwitterShare on FacebookShare on LinkedInShare on Google+

Matthew Nuzum

Posts Twitter Facebook

Web guy, big thinker, loves to talk and write. Front end web, mobile and UX developer for John Deere ISG. My projects: @dsmwebgeeks @tekrs @squaretap ✝
  • rlively

    Fantastic idea. It worked perfectly for testing an SSL website. It’s amazing how many so-called “web developers” have absolutely no idea what HTTP headers are or how their site gets served, but for those of us that do have an idea, this is a great tip. Thanks.

  • Bernard

    Thanks !!

  • Chuki

    Te answer is BAD REQUEST:

    400 Bad Request

    Bad Request
    Your browser sent a request that this server could not understand.

    Apache Server at …… Port 443


    • h2o

      Try with a sample

      GET /

  • neeraj kumar

    Thank you, the post helped me crack the bandit level 15.

  • Keith Tyler

    cat | openssl s_client connect= ….

  • Jan Gronemann

    So good. I come back every few years when I need to test this.

  • Mohamed

    Thank You. Helped me a lot

  • Mohamed

    Could you also add on to this article to include client authentication as well?