How-to Guides Security

How to Check an SSL Certificate

Check a website's HTTPS certificate: whether it validates, when it expires, which names it covers, who issued it and whether the chain is complete.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Steps

  1. Run the live check

    Type the hostname, such as www.example.com, into the SSL Certificate Checker and press Check Certificate. It makes a real TLS connection on port 443 and validates the certificate the way a strict client would.

  2. Read any verification error

    If validation fails, the error names the reason, for example certificate has expired, Hostname mismatch, self-signed certificate or unable to get local issuer certificate.

  3. Check the expiry date

    Read Valid Until and Days Until Expiry. The day count turns amber under 30 days and shows Expired once the date has passed.

  4. Check the names it covers

    Every hostname visitors use must appear in Subject Alternative Names. A wildcard such as *.example.com covers www.example.com but not example.com itself or a.b.example.com.

  5. Check who issued it

    Issuer names the certificate authority. Confirm it is the one you or your host actually use; an unexpected issuer can mean a different server is answering, or traffic is being intercepted.

  6. Decode the full chain for details

    Fetch the chain with openssl s_client -connect example.com:443 -servername example.com -showcerts and paste the PEM blocks into the Certificate Decoder. It shows key, usages, fingerprints and whether each certificate is Issued by the next certificate.

  7. Make sure visitors end up on HTTPS

    Trace http://example.com with the HTTP Redirect Chain Tracer to confirm it redirects to HTTPS, and run the Security Headers Analyzer to see whether HSTS tells browsers to stay there.

What you need

The hostname of the site, exactly as visitors type it, and optionally a terminal with OpenSSL to copy the certificate chain. The live check runs from this site's server; the decoder works entirely in your browser.

Reading the result

A healthy result for a site might look like this:

Field Value
Subject commonName=example.com
Issuer countryName=US, organizationName=Example Trust, commonName=Example Issuing CA
Valid From Sep 26 22:49:11 2026 GMT
Valid Until Dec 25 22:56:35 2026 GMT
Subject Alternative Names example.com, *.example.com

The certificate is valid for 90 days and 7 minutes, a typical lifetime for automatically renewed certificates. Checked on 10 October 2026 it has 76 days left. Both the bare domain and the wildcard are listed, so example.com and www.example.com are both covered.

If the check fails instead, the error tells you where to look:

Error text Meaning Usual fix
certificate has expired The Valid Until date has passed Renew, and check why automatic renewal failed
Hostname mismatch, certificate is not valid for '...' The name you typed is not in the SAN list Reissue with every hostname included
self-signed certificate Not issued by a trusted authority Replace with a CA-issued certificate
self-signed certificate in certificate chain The chain ends at a root clients do not trust Use a publicly trusted CA
unable to get local issuer certificate The server does not send its intermediate certificate Install the full chain file, not just the site certificate

In the decoder, each certificate gets a badge such as Valid for 76 more days, CA for authority certificates, and Issued by the next certificate when the chain is in the right order. Not issued by the next certificate means the server sends the chain in the wrong order or with the wrong intermediate.

Common pitfalls

  • Checking only the bare domain. example.com and www.example.com can be served by different servers with different certificates. Check every name people use.
  • Trusting your browser alone. Browsers often repair a missing intermediate, so the site looks fine to you while apps and API clients fail.
  • Pasting a URL with a path. The checker wants a hostname. It strips https://, but only port 443 is tested.
  • Ignoring the renewal date until it is too late. Short-lived certificates depend on automation. A falling day count that never resets means renewal is broken.
  • Treating the decoder as a validator. It shows what a certificate says; it does not verify signatures or revocation. Use the live check for that.

Going further

How the certificate, the key exchange and the chain of trust fit together during a TLS handshake is explained in How HTTPS and TLS Work.

Try these tools

SSL Certificate Checker

Check any domain's SSL/TLS certificate details server-side — issuer, subject, expiry date, and SAN list.

Certificate Decoder

Decode X.509 certificates and certificate signing requests (CSRs) in your browser: subject, issuer, validity, serial, public key.

HTTP Redirect Chain Tracer

Follow a URL's full redirect chain server-side and see every hop, status code, and the final destination.

Security Headers Analyzer

Check a website's HTTP security headers (HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

See also

  • Guide How HTTPS and TLS Work
    How the TLS 1.3 handshake, key exchange and certificate chain make a connection private and authenticated.
  • Glossary Digital certificate
    A digital certificate is a signed file that links a public key to an identity, such as a domain name, so others can trust that key.
  • Glossary TLS
    TLS (Transport Layer Security) is the cryptographic protocol that encrypts and authenticates connections, including HTTPS, email and VPNs.
  • Glossary HTTPS
    HTTPS is HTTP sent over an encrypted TLS connection, which keeps traffic private and confirms the identity of the server.
  • Glossary Public-key cryptography
    Public-key (asymmetric) cryptography uses a pair of linked keys: a public key anyone can have, and a private key kept secret.

Frequently Asked Questions

Browsers work around some server mistakes, most often a missing intermediate certificate, by fetching or caching it themselves. Many other clients, such as scripts, mail servers and apps, do not. The checker validates strictly, so it shows problems that some of your visitors will hit.

It means the connection is encrypted and the certificate authority checked that the owner controls the domain. It says nothing about the honesty of whoever runs the site; phishing sites routinely have valid certificates.

Back to the how-to guides
AdSense Placeholder
Slot: footer_leaderboard