$ openssl s_client -connect keycloak.localhost:443
CONNECTED(00000003)
depth=1 CN = Caddy Local Authority - ECC Intermediate
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0
verify return:1
---
Certificate chain
 0 s:
   i:CN = Caddy Local Authority - ECC Intermediate
 1 s:CN = Caddy Local Authority - ECC Intermediate
   i:CN = Caddy Local Authority - 2020 ECC Root
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIBxjCCAWygAwIBAgIQEk8XxSxfQskJvKH+35KMVzAKBggqhkjOPQQDAjAzMTEw
LwYDVQQDEyhDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSBFQ0MgSW50ZXJtZWRpYXRl
MB4XDTIwMDQyODAwNDkyMloXDTIwMDQyODEyNTAyMlowADBZMBMGByqGSM49AgEG
CCqGSM49AwEHA0IABN2n3GkrraSnH6boRklshtCSFeRdKUsT0CPIpwYuzKXXcqUK
SMof1zomBh7LLLEs5fs2RrSAeNFoCIYiCOlQIhqjgZQwgZEwDgYDVR0PAQH/BAQD
AgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU/0ou
sH2MSXb5NBzxFihO0soDUv8wHwYDVR0jBBgwFoAU4mK074AMtcdTx7vx8qNE0uN9
jpYwIAYDVR0RAQH/BBYwFIISa2V5Y2xvYWsubG9jYWxob3N0MAoGCCqGSM49BAMC
A0gAMEUCIQDoSBlHbD9YxsOOJgiVfBEx84CbR/X/kMu9D8PDnZL0zgIgMcymGpOn
CyhcwU8yU2hW6B7lKIJCRCK9VOcge+7GmO0=
-----END CERTIFICATE-----
subject=

issuer=CN = Caddy Local Authority - ECC Intermediate

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1276 bytes and written 384 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_128_GCM_SHA256
    Session-ID: 7BC5BE0C0E687B0242AFD0ED46739A0B699A085DF05C83D6FFC54E17A5A054EF
    Session-ID-ctx:
    Resumption PSK: E026FBD6C1920FB682261CFA3F58766DC4C4EEEFCF2B48863AB31A22EE53469D
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 604800 (seconds)
    TLS session ticket:
    0000 - e2 cd 27 ed 84 81 e8 fc-f8 30 76 d3 a7 66 93 e1   ..'......0v..f..
    0010 - cd 00 b7 dd 3c d8 5c 85-84 7e 5a 31 74 6b 1c 68   ....<.\..~Z1tk.h
    0020 - 2d 59 c6 c6 19 bd 94 35-e5 c1 f7 64 91 91 09 06   -Y.....5...d....
    0030 - 93 ef 44 21 dd d4 86 11-16 ad bf ed ec 7a 1e 87   ..D!.........z..
    0040 - ff 8d 29 ec d0 fd 86 1a-a1 7d a1 84 56 a0 34 15   ..)......}..V.4.
    0050 - c4 43 40 03 6e a9 c8 46-75 4d d2 4b f1 92 71 7b   .C@.n..FuM.K..q{
    0060 - 2d 6d fa 19 6f cc 31 21-58 c8 d7 00 bd 1b 30 9a   -m..o.1!X.....0.
    0070 - b9                                                .

    Start Time: 1588035076
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
    Extended master secret: no
    Max Early Data: 0
---