That's a bit simplistic. For example, you at the very least want to have a "-servername" there to account for SNI-only hosts. You'll then need to worry about prefixed and non-prefixed hosts (e.g., www.example.com and example.com). Then, what do you do if your web site relies on a third-party sites that uses WoSign? Yes, now you have to parse the HTML response, extract all links, and check those too.

Then there's also a question of servers other than HTTP, so you need to throw in a port scanner in there. And a tool to actively follow protocols, to discover MX hosts, maybe even look at SRV records, and so on.

For more accurate browser-like results, you might want to add "-servername somewhere" so that you get the response associated with the "somewhere" virtual host rather than the default response.

No need to prefix the command with `echo | '. If you want OpenSSL to have no standard input (so it closes its connection), just redirect standard input from /dev/null.

$ openssl ... </dev/null | grep ...

EDIT: This also avoids OpenSSL sending its only input character (the newline that echo produces) to the server, which will throw it away anyway.