I'm trying to parse some output from SSL client to check if a bunch of servers have valid certificates. I'm looking at the output of this command:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -subject -dates
I notice that wildcard certificates issued from Let's Encrypt only list "CN = example.com" in "subject" field, while wildcard certificates issued from some other CA use "CN = *.example.com"
Is this normal? Will there be some certificates that are listed as "CN = example.com" in the "subject" field which are not wildcard and would break in the browser if I try to open "subdomain.example.com"?
Or is there maybe some better way to validate if certificate is for correct domain on the command line?
Thanks.