Network diagnostics.

Feb. 10, 2026, 8:56 a.m. GMT-5

Here are some notes on some programs to assist in network diagnostics.

""

OpenSSL#

OpenSSL is a robust toolkit for SSL/TLS protocols and general-purpose cryptography.

Check SSL Certificate#

user@~: $ echo | openssl s_client -connect thekevinwang.com:443 -servername thekevinwang.com
Connecting to 13.226.94.11
CONNECTED(00000006)
depth=2 C=US, O=Amazon, CN=Amazon Root CA 1
verify return:1
depth=1 C=US, O=Amazon, CN=Amazon RSA 2048 M03
verify return:1
depth=0 CN=thekevinwang.com
verify return:1
---
Certificate chain
 0 s:CN=thekevinwang.com
   i:C=US, O=Amazon, CN=Amazon RSA 2048 M03
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Jul 25 00:00:00 2025 GMT; NotAfter: Aug 23 23:59:59 2026 GMT
 1 s:C=US, O=Amazon, CN=Amazon RSA 2048 M03
   i:C=US, O=Amazon, CN=Amazon Root CA 1
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Aug 23 22:26:04 2022 GMT; NotAfter: Aug 23 22:26:04 2030 GMT
 2 s:C=US, O=Amazon, CN=Amazon Root CA 1
   i:C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: May 25 12:00:00 2015 GMT; NotAfter: Dec 31 01:00:00 2037 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF2DCCBMCgAwIBAgIQCgsbatGsnsWAtzmqVybs8DANBgkqhkiG9w0BAQsFADA8
MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRwwGgYDVQQDExNBbWF6b24g
UlNBIDIwNDggTTAzMB4XDTI1MDcyNTAwMDAwMFoXDTI2MDgyMzIzNTk1OVowGzEZ
MBcGA1UEAxMQdGhla2V2aW53YW5nLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAMUh+YTbAmCp/siyXWsRDTVaDjWOVtsuwS1qbRp1+NC7tqujwP8k
N6dCo9KWomb2oCiR2YxX22kNSZyeYBmt1xUblkpN2LGiZkrYCcdbFnsR2zVCyLPv
0Iv3dsa+sjXjVkrRZ28K3iyYfSbLJfG6TuNScNcB+R7AheHCYLOuX2LePRtVfrHd
eTaHaX9Om6RcfVKCjo3pkSRM9JFxMqI4eTiCpgThsEbYxXVr7SMDjN6XMvSVo1Ex
e24eYO9/chyw0z7lwDckeVZfPN3GrDSESN3VUUeo3MlY821XIRf8rg49zcGF8l1p
Z1Q5/izz71nvhHD6AAm0u0nCOVyJ+6jX2XcCAwEAAaOCAvUwggLxMB8GA1UdIwQY
MBaAFFXZGF/SHMwB4Vi0vqvZVUIB1y4CMB0GA1UdDgQWBBT3/tXpJv2Bz3vuadaN
iglyLBEUizAxBgNVHREEKjAoghB0aGVrZXZpbndhbmcuY29tghR3d3cudGhla2V2
aW53YW5nLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATAOBgNVHQ8BAf8EBAMCBaAw
EwYDVR0lBAwwCgYIKwYBBQUHAwEwOwYDVR0fBDQwMjAwoC6gLIYqaHR0cDovL2Ny
bC5yMm0wMy5hbWF6b250cnVzdC5jb20vcjJtMDMuY3JsMHUGCCsGAQUFBwEBBGkw
ZzAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AucjJtMDMuYW1hem9udHJ1c3QuY29t
MDYGCCsGAQUFBzAChipodHRwOi8vY3J0LnIybTAzLmFtYXpvbnRydXN0LmNvbS9y
Mm0wMy5jZXIwDAYDVR0TAQH/BAIwADCCAX4GCisGAQQB1nkCBAIEggFuBIIBagFo
AHYA1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXcAAAGYP8WitwAABAMA
RzBFAiEA8arQzA7zSVMtrMN4vX5CiOnwBaOjMNtigzGT1PXSI1YCIDNfzUpk03t1
GMQ/A0BblO3GKxJ89VYMwqn3vdVRc3STAHcAwjF+V0UZo0XufzjespBB68fCIVoi
v3/Vta12mtkOUs0AAAGYP8Wi5AAABAMASDBGAiEAl/dEd3Y7U3R76HWXrDkVp0Gs
MaU232cggbAg3KM0l7MCIQDuC7G1mUx2uYwtMuglTNONZn1DZI0LeJW0c0zi9QBD
iwB1AJROQ4f67MHvgfMZJCaoGGUBx9NfOAIBP3JnfVU3LhnYAAABmD/Fov8AAAQD
AEYwRAIgEjO13t065Bp/Iff8+iHzgKgCV+XNCow2J28TaWWT+nwCIHMW9LY1ycs5
hMSBy5Mw++xUJRVmfKS7HlfL7ccbBohQMA0GCSqGSIb3DQEBCwUAA4IBAQAhMdVM
2KbNbkqHu97tJvvKFaHa7yNQGK2Ksazr5XQSKF7euFIyjkmiuF1LktQx0AK0Q0bh
1r7yKJKx4FVe01D2RKyyDb++BVaw1b+pH/tc5wYFJ/C4eFxT9E0ZX1EZ/iKhLnLY
CVed0TJ1LrGROos56WCOxAR9s8/uBxBG+X2ubWkNr3lFgDUmlDuwmRy970v8szjH
TBDoSycImhzpbhirVBScotll9wVYB4fFfyG/K79PPf6K1LdxQJXZopR57xZbVcxf
7nlu0a6DOT3Hc7wNlZT+M0zjlFVQb9NMfnDOriXOgIHX+knTHllklauaBDF1VyzX
+xUJhcmHmduN/+Us
-----END CERTIFICATE-----
subject=CN=thekevinwang.com
issuer=C=US, O=Amazon, CN=Amazon RSA 2048 M03
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: rsa_pss_rsae_sha256
Negotiated TLS1.3 group: X25519MLKEM768
---
SSL handshake has read 5438 bytes and written 1611 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Protocol: TLSv1.3
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
DONE

Check Certificate Expiration#

user@~: $ echo | openssl s_client -connect thekevinwang.com:443 -servername thekevinwang.com 2>/dev/null | openssl x509 -noout -dates
notBefore=Jul 25 00:00:00 2025 GMT
notAfter=Aug 23 23:59:59 2026 GMT

Whois#

Whois queries domain registration information, including registrar details, nameservers, and expiration dates.

whois only works for eTLD+1 (the registrable domain). Subdomains like foo.thekevinwang.com are simply DNS records under the parent and won't have separate Whois records.

Basic Domain Lookup#

user@~: $ whois thekevinwang.com

Find Domain Registrar#

user@~: $ whois thekevinwang.com | grep -i "registrar:"

   Registrar: Amazon Registrar, Inc.
Registrar: Amazon Registrar, Inc.

user@~: $ whois amazonaws.com | grep -i "registrar:"

   Registrar: MarkMonitor Inc.
Registrar: MarkMonitor, Inc.

user@~: $ whois amazon.com | grep -i "registrar:"

   Registrar: MarkMonitor Inc.
Registrar: MarkMonitor, Inc.

user@~: $ whois vercel.com | grep -i "registrar:"

   Registrar: Amazon Registrar, Inc.
Registrar: Amazon Registrar, Inc.

Check Domain Expiration#

user@~: $ whois thekevinwang.com | grep -i "expir"

Dig#

Dig (Domain Information Groper) is a DNS lookup tool.

user@~: $ dig thekevinwang.com

Query Specific Record Type#

user@~: $ dig thekevinwang.com A

user@~: $ dig +short TXT cloudflare.com

Short Answer Format#

user@~: $ dig +short thekevinwang.com

Query Specific DNS Server#

dig @8.8.8.8 thekevinwang.com

My own use cases#

DMARC

https://www.cloudflare.com/learning/dns/dns-records/dns-dmarc-record/

user@~: $ dig _dmarc.amazon.com TXT +short
"v=DMARC1;" "p=quarantine;" "pct=100;" "rua=mailto:report@dmarc.amazon.com;" "ruf=mailto:report@dmarc.amazon.com"

ACME Challenge

https://letsencrypt.org/docs/challenge-types/

user@~: $ dig _acme-challenge.railway.app TXT +short
4caa10de-57dc-480e-a0bb-694b06fa7f3d.10.authorize.certificatemanager.goog.

Reverse DNS

user@~: $ dig github.com +short
140.82.113.4

user@~: $ dig -x 140.82.112.4 +short
lb-140-82-112-4-iad.github.com.