❯ curl -Ikvvv https://untrusted-root.badssl.com/
*   Trying 104.154.89.105:443...
* Connected to untrusted-root.badssl.com (104.154.89.105) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: C=US; ST=California; L=San Francisco; O=BadSSL; CN=*.badssl.com
*  start date: Apr 24 00:01:45 2023 GMT
*  expire date: Apr 23 00:01:45 2025 GMT
*  issuer: C=US; ST=California; L=San Francisco; O=BadSSL; CN=BadSSL Untrusted Root Certificate Authority
*  SSL certificate verify result: self-signed certificate in certificate chain (19), continuing anyway.
* using HTTP/1.1
> HEAD / HTTP/1.1
> Host: untrusted-root.badssl.com
> User-Agent: curl/8.0.1
> Accept: */*
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/1.10.3 (Ubuntu)
Server: nginx/1.10.3 (Ubuntu)
< Date: Wed, 26 Apr 2023 14:18:04 GMT
Date: Wed, 26 Apr 2023 14:18:04 GMT
< Content-Type: text/html
Content-Type: text/html
< Content-Length: 600
Content-Length: 600
< Last-Modified: Mon, 24 Apr 2023 00:02:00 GMT
Last-Modified: Mon, 24 Apr 2023 00:02:00 GMT
< Connection: keep-alive
Connection: keep-alive
< ETag: "6445c6f8-258"
ETag: "6445c6f8-258"
< Cache-Control: no-store
Cache-Control: no-store
< Accept-Ranges: bytes
Accept-Ranges: bytes

< 
* Connection #0 to host untrusted-root.badssl.com left intact

not so useful:

* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=*.google.com
*  start date: Apr  3 08:17:58 2023 GMT
*  expire date: Jun 26 08:17:57 2023 GMT
*  issuer: C=US; O=Google Trust Services LLC; CN=GTS CA 1C3
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* h2h3 [:method: HEAD]

openssl s_client -showcerts -servername untrusted-root.badssl.com -connect untrusted-root.badssl.com:443

echo | openssl s_client -showcerts -servername untrusted-root.badssl.com -connect untrusted-root.badssl.com:443

echo | openssl s_client -showcerts -servername nixos.org -connect nixos.org8:443

echo | openssl s_client -showcerts -servername nixos.org -connect nixos.org:443