Application Layer · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
openssl s_client
openssl s_client -connect host:443 -servername host </dev/null | Handshake details and the served chain |
… -showcerts | Print every certificate the server sends |
… | openssl x509 -noout -subject -issuer -dates -ext subjectAltName | Summarise the leaf certificate |
… -alpn h2,http/1.1 | Which application protocol the server picks |
openssl verify -CAfile ca.crt server.crt | Does this chain validate against this CA? |
curl
curl -v https://host/ | TLS version, cipher, certificate, then HTTP |
curl --cacert ca.crt https://host/ | Trust a specific (private) CA |
curl --cert client.crt --key client.key https://host/ | Present a client certificate (mTLS) |
Test protocol versions
curl -sI --http1.1 https://host/ | head -1 | Force HTTP/1.1 |
curl -sI --http2 https://host/ | head -1 | Try HTTP/2 (via ALPN) |
curl -sI --http3 https://host/ | head -1 | Try HTTP/3 (needs a curl built with HTTP/3 support) |
curl -w '%{http_version} %{time_connect} %{time_starttransfer}\n' -o /dev/null -s https://host/ | Version and timing |
grpcurl
grpcurl -plaintext localhost:50051 list | Services exposed (needs server reflection) |
grpcurl -plaintext localhost:50051 describe orders.v1.Orders | Methods and messages |
grpcurl -plaintext -d '{"id": "42"}' localhost:50051 orders.v1.Orders/GetOrder | Call a method with JSON input |
grpcurl -plaintext localhost:50051 grpc.health.v1.Health/Check | Standard health check |
Kubernetes
readinessProbe: grpc: {port: 50051} | Native gRPC health probes |
clusterIP: None | Headless Service so clients can see every pod (client-side balancing) |
One command per layer
dig +short shop.example.com | DNS: does the name resolve to the right address? |
nc -vz <ip> 443 | TCP: can I connect at all? |
openssl s_client -connect <ip>:443 -servername shop.example.com </dev/null | TLS: which certificate, which chain? |
curl -v --resolve shop.example.com:443:<ip> https://shop.example.com/ | HTTP: status, headers, timings |
kubectl get endpointslices -n shop | Service: are there ready backends? |
kubectl -n shop exec deploy/web -- wget -qO- -T 3 http://api:8080/health | Pod-to-pod: does the internal hop work? |
ping -M do -s 1422 <pod-ip> | MTU: do full-size packets survive the overlay? |
