**WARNING:** `openssl s_client` is designed only as a diagnostic tool and is NOT suitable if you care even slightly about security. By default it continues on verification failures so you get absolutely zero security.

You must specify the options `-verify_return_error -verify_hostname <hostname>` to get even a semblance of security; however I don't know if they are sufficient, and the fact that they are not enabled by default is a massive red flag that tells you this tool was not designed to be secure.

As an alternative, I suggest using `gnutls-cli <host>[:<port>]` or `socat - SSL:<host>:<port>` (if they are installed; unfortunately they are not common). They pass the "Certificate" tests on https://badssl.com/ except for "pinning-test".