How to Check an SSL Certificate: Validity, Issuer and Chain

The quickest way to check an SSL certificate is to click the icon to the left of the address in your browser. For a full check including the certificate chain use an online check; for servers without a browser use the command line.

The five things that matter

Method 1: in the browser

1. Open the site and click the icon to the left of the address.
2. Choose "Connection is secure", then "Certificate is valid".
3. Read who it was issued to, who issued it and the expiry date.

The browser shows what it sees itself; a missing chain often goes unnoticed here.

Method 2: online check

An online check opens your site from outside and reports the expiry date, domains, issuer and the chain that is served. That is what visitors and search engines see. Enter your domain in the SSL checker; it is free.

Method 3: command line with OpenSSL

openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -subject -issuer -dates

The output gives the subject, the issuer and the validity dates. For other services change the port, for example 465 for SMTP over TLS.

Checking a certificate file before installing it

If you have the certificate as a file, paste it into the certificate decoder: it shows who it was issued to, which domains it covers and when it expires. The matcher on the same page tells you whether a certificate and a CSR belong together. Never paste your private key.

How often?

Certificates are valid for at most 200 days, and 100 days from March 2027. Check immediately after every installation and set a reminder 30 days before expiry.