Read cert
$ openssl s_client -host <hostname> -port 443 | openssl x509 -noout -text
Dump cert chain
$ openssl s_client -showcerts -servername <hostname> -connect <hostname>:443
Read CRL
$ openssl crl -inform {DER|PEM} -noout -text -in <crl file>
Test connection
$ openssl s_client -servername <hostname> -connect <hostname>:443 -CAfile <Root CA cert file>