openssl s_client allows connection while curl does not

grief@rocket:/$ curl https://wrong.host.badssl.com
curl: (60) SSL: no alternative certificate subject name matches target host name 'wrong.host.badssl.com'
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.


grief@rocket:/$ echo "Q" | openssl s_client wrong.host.badssl.com:443 2>&1|grep Verification
Verification: OK

How can I test if the certificate matches the hostname using openssl (1)?

Solution 1:

You need to enable hostname verification using the -verify_hostname <host> option.