[root@dragon ~]# openssl s_client -showcerts -connect shutok.ru:443
CONNECTED(00000003)
depth=0 CN = shutok.ru
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = shutok.ru
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = shutok.ru
verify return:1
---
Certificate chain
0 s:CN = shutok.ru
i:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIGKzCCBROgAwIBAgIQOdPdHsepaCznNSamxPD3yzANBgkqhkiG9w0BAQsFADCB
jzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQD
Ey5TZWN0aWdvIFJTQSBEb21haW4gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENB
MB4XDTIyMDIxMjAwMDAwMFoXDTIzMDIxMjIzNTk1OVowFDESMBAGA1UEAxMJc2h1
dG9rLnJ1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAojyG27bjhPLy
Znj9v+hlGQHRdNJzCt0WvSCWPSDJuk6V1nadRl6bGfyHfFjQmPa7rVKHpr0So/Nv
JWFbPLsj5bh92ynkG4H+T4VQJdAd0ntY6r0oP/n84H5zKdRv8pHriNYxZk4PM37T
SufXk0sPYg32nBHc1f2PqadPfVMrbkfaBhw/dcBtZi/iPJu3VNn55I24C8x3Tg5i
/BEsut6s9y53xBLzvbPzF0WufPk9pEr+VY7ljbw4mK15eTUspk0aTelpS7txR7u/
hdWMsLPwkxDLNMMkz2ZKnTEfIay2ikqh6gRMkFtSmkQVCnecYroWOdAuTh297POV
Okw3tMe3DwIDAQABo4IC+zCCAvcwHwYDVR0jBBgwFoAUjYxexFStiuF36Zv5mwXh
uAGNYeEwHQYDVR0OBBYEFMxqbTLdg/oL7LaNJ/hIvZ11miIoMA4GA1UdDwEB/wQE
AwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
AjBJBgNVHSAEQjBAMDQGCysGAQQBsjEBAgIHMCUwIwYIKwYBBQUHAgEWF2h0dHBz
Oi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAECATCBhAYIKwYBBQUHAQEEeDB2ME8G
CCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FEb21h
aW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRw
Oi8vb2NzcC5zZWN0aWdvLmNvbTAjBgNVHREEHDAagglzaHV0b2sucnWCDXd3dy5z
aHV0b2sucnUwggF/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB3AK33vvp8/xDIi509
nB4+GGq0Zyldz7EMJMqFhjTr3IKKAAABfu2Y2SkAAAQDAEgwRgIhAOBsQYeXBJEF
L5ve0gQ9yu5IeU/4lscmsOR/sFdfo6amAiEA/ElWRjuEDsawhbx0mW/Xbw+Kfu9d
ibZZsaavNNIE9hgAdgB6MoxU2LcttiDqOOBSHumEFnAyE4VNO9IrwTpXo1LrUgAA
AX7tmNjoAAAEAwBHMEUCIAWDLJ7DkVDgT6+juMK/uT4cXb7tagNGy9pTdaIAhddL
AiEA4mAfxZXJrQ5/uhsv7tnFtsXg838Vihxhi4qH9RMBT7kAdgDoPtDaPvUGNTLn
Vyi8iWvJA9PL0RFr7Otp4Xd9bQa9bgAAAX7tmNi/AAAEAwBHMEUCIQCMnC1uYLbu
zlxBMj6Bim0EymII6ZVWWPb1VpAyOgwulgIgOOz1/mSZPJI+PlWQ4EKO7jMDy+9m
eGvXV3KKEaBwsDQwDQYJKoZIhvcNAQELBQADggEBAGlu2tUXfGi1qsLH8O1R5J8z
f2ImEJtOx39Piz/nR5XElQYDj+S0LHmVfgQqFZcW5BWQ9Q4/QYvoF87RWRCZPGDF
yO+n+v1g1d9VCPBVbmvbnlrACvAxgiCMUsmEJUbC1yYV5QlfduRzLabW9jE2OOuz
jVJklDotix222rWgs1vZlzgnr/WNITW6BthWaHJ19GVsWyoNVrGCwBhgaODr0L/K
3tU+voyUKB/RW6uwLVQHm/eYPFH2LusYe0zylrr+BkH3pXzs6UUvvlNkhp9UN2XP
iY2OxsvbO/OrYXGlqjXtfo+OH3n9XHiMBnJgRnGHbeUfHUxsp1BaKUHAmnIjK44=
-----END CERTIFICATE-----
---
Server certificate
subject=CN = shutok.ru

issuer=C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2143 bytes and written 387 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 5A48497811F64AE925D979DD64E430C73510B273F4FE97EFCA99F3662304FC78
Session-ID-ctx:
Resumption PSK: 974E850B78D5D5352B48CB2ED8045E94503B2022E3B76AE4E5A1023118E104BC90EB54DB058BAED03E8B3793ACF7C65A
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 600 (seconds)
TLS session ticket:
0000 - 3c fd 3b 71 e3 64 61 cd-b1 be 55 23 9e 42 85 52 <.;q.da...U#.B.R
0010 - 64 08 d9 fc 19 2d 1f af-d0 95 d0 87 91 19 33 cf d....-........3.
0020 - ae 43 61 46 93 a8 4e c2-a2 07 56 18 a2 7c 42 ac .CaF..N...V..|B.
0030 - 9c 42 de 4c 99 c2 3d 70-7d 6c 03 a7 94 c7 48 92 .B.L..=p}l....H.
0040 - 4e 5f d4 c9 62 99 52 b5-3d 04 ed a0 09 77 c8 b0 N_..b.R.=....w..
0050 - db 5d ba 72 b1 53 11 0b-f6 73 56 ce 19 db d6 21 .].r.S...sV....!
0060 - b0 26 59 d4 ea c1 db 0e-8b e4 f7 9e f6 1e 6a 71 .&Y...........jq
0070 - 96 4d 3e ba 82 45 16 d0-b7 39 9e b4 b4 b2 64 64 .M>..E...9....dd
0080 - 7b bd 74 90 93 3d d4 0f-ff 09 a0 0e 1f 64 b2 19 {.t..=.......d..
0090 - 1a b5 5d a3 03 05 1a c0-ad b0 d5 04 d2 8b d7 d3 ..].............
00a0 - 1b 7d b1 b4 36 e8 72 ed-0d 6d bb 81 74 ce 44 75 .}..6.r..m..t.Du
00b0 - 28 4f aa f0 42 7c 8e 6a-08 4c 36 ce 62 91 65 07 (O..B|.j.L6.b.e.
00c0 - f8 d4 11 38 ad 67 10 08-ac d7 e5 56 41 e4 68 87 ...8.g.....VA.h.
00d0 - 34 53 c0 5c 33 d6 a5 09-24 af 49 a2 c8 c5 da bf 4S.\3...$.I.....

Start Time: 1648361627
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: D0D2C08D9EBE60031C0E81812BD713790E0191829286459C4D910F96CF2217AF
Session-ID-ctx:
Resumption PSK: 9E99BFEDA6872A5A0BFCB4FEFA0DCE0974072B8B636F2DD6B243C92BEECD1D38882308F83CD4A9782B36F6B2FB39893B
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 600 (seconds)
TLS session ticket:
0000 - 3c fd 3b 71 e3 64 61 cd-b1 be 55 23 9e 42 85 52 <.;q.da...U#.B.R
0010 - df 6e dd 62 6f da 68 12-b1 b4 cb 26 75 3a 2b 58 .n.bo.h....&u:+X
0020 - 48 6b 03 d6 99 c3 c8 78-b7 42 29 49 b9 f4 17 73 Hk.....x.B)I...s
0030 - 66 97 e6 81 35 0d 62 52-dd f1 b5 bc 76 a8 e3 91 f...5.bR....v...
0040 - 73 2c 27 0a 83 d3 69 7f-db d8 f5 5a 7e 71 88 05 s,'...i....Z~q..
0050 - d2 39 19 f6 b5 d7 a8 97-85 21 48 5f 75 a8 7e 38 .9.......!H_u.~8
0060 - 1e f5 fc 2c fd 70 0e 88-d1 75 57 57 72 28 54 cd ...,.p...uWWr(T.
0070 - 2f c7 2c 63 a1 7e 9a e2-ea 1a 6d 11 f2 06 a4 c8 /.,c.~....m.....
0080 - 65 f6 f8 9d c2 9a 77 a4-28 78 41 48 fe 1c cc 12 e.....w.(xAH....
0090 - 57 09 3a 07 1b 14 cc 5d-56 f3 fa f6 3b 6b af e4 W.:....]V...;k..
00a0 - 71 e9 27 51 dc 1c d6 bf-1d 8b ca 4a 48 e9 1d 64 q.'Q.......JH..d
00b0 - fe b0 75 ea 2d fd 7f f5-a1 9f 35 36 9f 9e 20 28 ..u.-.....56.. (
00c0 - 45 0d 7b 67 47 4e 4a 32-8b 0d 11 fd 93 86 ce 84 E.{gGNJ2........
00d0 - 7d e9 8e 3b 4e 10 61 ce-46 9a c3 f9 2a c0 f6 07 }..;N.a.F...*...

Start Time: 1648361627
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK