When I load https://objective-see.com in Safari, it shows me a certificate with CN=objective-see.com. However, when I retrieve the certificate using

echo -e | openssl s_client -connect "objective-see.com:443" 2>/dev/null | awk '/BEGIN CERTIFICATE/, /END CERTIFICATE/ { print }'

I get CN=AlphaSSL CA - SHA256 - G2

Why? Is this a CDN phenomenon?

2 Answers 2


openssl s_client does not use Server Name Indication (SNI) by default while the browser does. To force SNI use the -servername parameter:

$ openssl s_client -connect objective-see.com:443 -servername objective-see.com |\
  openssl x509 -text
Subject: CN=objective-see.com

If that still does not work, could it be due to client certificate-based authentication failures? The symptoms are

  • The SSL handshake failure while client certificate authenticating
  • system logs error messages indicating SSL handshake failures.

A client usually has its store of Certificate Authority (CA) certificates in its Trusted Device Certificate so if the certificate is not there, then the system logs will indicate error.

You will need to add the unknown or new certificate as a trusted root certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .