openssl for iPhone (2026): Checking Certificates from iOS
Short version. There is no openssl binary on iOS and no shell to run it in. Certificate inspection itself works fine: PingKit shows the full chain, expiry, subject, SANs and signature algorithm free. What it does not show is the negotiated TLS version or cipher suite, so protocol and cipher auditing still needs a computer.
openssl s_client -connect host:443 is the reflex for "what certificate is this server actually presenting". On an iPhone there is no shell, but the question is still answerable.
Full disclosure: I build PingKit, so weigh the recommendation accordingly. The limits section below is not padding, and the point of these pages is to tell you when the answer is "use a computer".
What You Can Check on iPhone
PingKit's SSL Inspector connects to a host and reports:
- The full certificate chain, leaf through intermediates to the root
- Expiry dates, which is the reason most people look
- Subject and issuer
- Subject Alternative Names, so you can confirm a certificate actually covers the hostname
- Signature algorithm
That answers the common questions: when does this expire, is the chain complete, does it cover this subdomain, and who issued it.
What It Does Not Show
Stated plainly, because this is the real gap: SSL Inspector does not report the negotiated TLS version or cipher suite. If you are auditing whether a server still permits TLS 1.0, or which ciphers it offers, this will not tell you and you need openssl, testssl.sh or an online scanner from a computer.
| openssl usage | On iPhone |
|---|---|
| View certificate chain | Yes |
| Check expiry date | Yes |
| Read SANs | Yes |
| Issuer and signature algorithm | Yes |
| Negotiated TLS version | No |
| Cipher suite | No |
| Test a specific protocol version | No |
| Generate keys or CSRs | No |
| Encrypt or decrypt files | No |
| SMTP or IMAP STARTTLS | No |
openssl is a general cryptography toolkit and PingKit is not trying to be one. The overlap is certificate inspection, which happens to be the most common reason people reach for s_client.
Catching expiry before it bites. Checking manually only helps if you remember. Every device can monitor one domain free in Cert Monitor with expiry alerts included, and Guardian Plus raises the cap to 25. Checks run hourly and warn at 30, 14, 7 and 1 days before expiry, on a fixed schedule rather than adjustable thresholds.
Other Options
iSH can install openssl inside its Alpine environment, which gets you the real command including s_client. It is slow, and network behaviour inside the emulator is not always representative.
SSH to a server from an iOS terminal client gives you a real openssl on a real machine, which is the complete answer when you have somewhere to connect to.
Online scanners in Safari will grade a public server's TLS configuration properly, including protocols and ciphers. They cannot reach an internal host.
Frequently Asked Questions
Can I run openssl on an iPhone?
Not natively. iOS has no shell and no way to run arbitrary binaries. You can install openssl inside the iSH Alpine Linux emulator from the App Store, or use a native app for certificate inspection specifically.
How do I check a website's SSL certificate expiry on iPhone?
Use a certificate inspection tool. PingKit's SSL Inspector shows the full chain with expiry dates, subject, issuer, Subject Alternative Names and signature algorithm, free.
Can an iPhone app show which TLS version a server is using?
PingKit's SSL Inspector does not report the negotiated TLS version or cipher suite; it covers the certificate itself. Protocol and cipher auditing needs openssl, testssl.sh or an online scanner run from a computer.
How do I check whether a certificate covers a subdomain?
Look at the Subject Alternative Names in the certificate. A certificate is only valid for the names listed there, so if the subdomain is absent, browsers will reject it even though the certificate is otherwise valid.
Can I get alerts before a certificate expires?
PingKit's Cert Monitor watches one domain free on every device, and Guardian Plus raises the cap to 25. It checks hourly and alerts at 30, 14, 7 and 1 days before expiry, on a fixed schedule rather than an adjustable threshold.
Inspect the certificate from your phone
Full chain, expiry, subject, issuer, SANs and signature algorithm. Free, alongside DNS, WHOIS, HTTP analysis and 15 more tools.
Download PingKit Free