How to Check SSL Certificate: Browser, Command Line & Online Tools

Published 2026-04-19 · 9 min read

SSL/TLS certificates are essential for website security, encrypting data between browsers and servers. But certificates expire, get misconfigured, or use weak protocols. Regularly checking your SSL certificate helps prevent security warnings, downtime, and trust issues. This guide covers every method to check SSL certificates — from clicking the padlock to advanced OpenSSL commands.

What is an SSL Certificate?

An SSL (Secure Sockets Layer) certificate — technically now TLS (Transport Layer Security) — is a digital certificate that authenticates a website's identity and enables encrypted connections. When you see the padlock icon and "https://" in your browser, the site has a valid SSL certificate.

SSL certificates contain: the domain name(s) they cover, the certificate authority (CA) that issued it, the validity period (typically 90 days to 1 year), the public key for encryption, and the digital signature verifying its authenticity. Without a valid SSL certificate, browsers show security warnings that drive away visitors and hurt SEO rankings.

Check SSL in Your Browser

Google Chrome

Visit the website (must use https://)
Click the padlock icon in the address bar
Click "Connection is secure" → "Certificate is valid"
View details: Issued To, Issued By, Valid From/To, Serial Number

For more detail, open DevTools (F12) → Security tab. This shows the protocol version, cipher suite, and certificate chain.

Firefox

Click the padlock icon → "Connection secure" → "More Information"
Click "View Certificate" for the full certificate viewer
Firefox shows a clean, organized certificate detail page with all fields

Check SSL with OpenSSL

OpenSSL provides the most detailed certificate inspection from the command line.

View Certificate Details

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -text

Check Expiry Date Only

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

Output:

notBefore=Jan 15 00:00:00 2026 GMT
notAfter=Apr 15 23:59:59 2026 GMT

Check Certificate Chain

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

Check with curl

curl -vI https://example.com 2>&1 | grep -A6 "Server certificate"

Check SSL with Online Tools

If you prefer a visual interface, several tools can check SSL certificates:

mydnsreport.com SSL Guide — Follow the command-line methods above to check certificate details, expiry, issuer, and validity.
SSL Labs (ssllabs.com) — The most thorough SSL test, grading your configuration A+ to F with detailed recommendations.
SSL Shopper — Quick checker focused on certificate chain validation and expiry countdown.

What to Check in an SSL Certificate

Expiry Date

Certificates typically last 90 days (Let's Encrypt) to 1 year. Expired certificates cause browser security warnings. Set up automated renewal or monitoring alerts.

Domain Coverage (SANs)

Check Subject Alternative Names (SANs) to ensure the certificate covers all your domains and subdomains, including www and non-www versions.

Certificate Chain

The chain must be complete: your certificate → intermediate CA → root CA. Missing intermediate certificates cause errors on some browsers/devices.

Protocol Version

TLS 1.2 and 1.3 are secure. TLS 1.0 and 1.1 are deprecated and should be disabled. SSL 3.0 is critically insecure.

Key Strength

RSA keys should be at least 2048-bit. ECDSA (256-bit+) keys are preferred for better performance and security.

Issuer Trust

Verify the certificate is issued by a trusted Certificate Authority. Self-signed certificates trigger browser warnings for public websites.

Common SSL Issues & Fixes

NET::ERR_CERT_DATE_INVALID

Cause: Certificate has expired

Fix: Renew the certificate. Use certbot for Let's Encrypt auto-renewal: certbot renew --dry-run

NET::ERR_CERT_COMMON_NAME_INVALID

Cause: Certificate doesn't match the domain

Fix: Ensure the certificate's SANs include all domains you're using (www and non-www).

ERR_CERT_AUTHORITY_INVALID

Cause: Self-signed or untrusted CA

Fix: Use a certificate from a trusted CA (Let's Encrypt is free). Ensure the full chain is installed.

ERR_SSL_PROTOCOL_ERROR

Cause: SSL/TLS misconfiguration

Fix: Check your web server's SSL configuration. Ensure TLS 1.2+ is enabled and cipher suites are correctly set.

Mixed Content Warning

Cause: HTTP resources on HTTPS page

Fix: Update all internal resource URLs to use https:// or protocol-relative URLs (//).

SSL Certificate Types

Type	Validation	Best For	Cost
DV	Domain only	Blogs, small sites	Free (Let's Encrypt)
OV	Organization verified	Business websites	$50-200/yr
EV	Extended validation	E-commerce, banking	$100-500/yr
Wildcard	*.domain.com	Multiple subdomains	$50-300/yr

Automate SSL Monitoring

Don't wait for SSL errors — monitor certificates proactively:

Cron job with OpenSSL: Schedule a daily script to check certificate expiry and send alerts when it's within 30 days.
Let's Encrypt auto-renewal: Configure certbot with a cron job or systemd timer for automatic renewal.
CAA records: Set up CAA DNS records to restrict which CAs can issue certificates for your domain.
CT monitoring: Subscribe to Certificate Transparency logs to get alerts when new certificates are issued for your domain.

Frequently Asked Questions

How do I check if a website has SSL?

Look for the padlock icon and 'https://' in the URL bar. Click the padlock to view certificate details. No padlock or 'Not Secure' label means no valid SSL.

How do I check SSL certificate expiry?

Click the padlock icon → view certificate → check 'Valid to' date. Or run: openssl s_client -connect domain.com:443 | openssl x509 -noout -dates

Why does my SSL certificate show as invalid?

Common causes: expired certificate, domain mismatch, incomplete certificate chain, self-signed certificate, or wrong server configuration.

How often should I check my SSL certificate?

Monitor continuously with automated tools. At minimum, check monthly and set up alerts for 30 days before expiry. Let's Encrypt certificates expire every 90 days.

Explore More Tools

Check out our free developer and network tools for DNS, WHOIS, and more.