To check an SSL certificate, click the icon left of the address bar and open the certificate details to see who issued it, which hostnames it covers and when it expires. For a fuller check, including the certificate chain, run openssl s_client or use a free online SSL checker. A healthy certificate is unexpired, matches the hostname and chains to a trusted root.
This guide covers each method step by step, explains what every field means, and shows how to fix the most common problems before visitors see a warning.
Key takeaways
- Click the icon beside the address bar to see a certificate's issuer, covered hostnames and expiry date.
- Use openssl s_client with -servername or an online checker to catch missing intermediates your browser may hide.
- Fix chain errors by installing the full chain file, such as fullchain.pem, rather than the certificate alone.
- Let's Encrypt stopped expiry reminder emails in June 2025, so automate renewal and monitor expiry independently.
What should I check on an SSL certificate?
| Field | What to look for | Why it matters |
|---|---|---|
| Expiry (Not After) | Comfortably in the future, renewing automatically | An expired certificate triggers a full-page browser warning |
| Hostnames (Subject Alternative Name) | Includes every name you use, e.g. example.com and www.example.com |
A missing name causes a "name mismatch" error |
| Issuer | A publicly trusted CA such as Let's Encrypt, Sectigo, DigiCert or Google Trust Services | Self-signed or private CAs aren't trusted by browsers |
| Chain | Server sends the leaf certificate plus intermediate(s) | Missing intermediates break some browsers, apps and API clients |
| Key and signature | RSA 2048-bit or larger, or ECDSA | Weak keys are rejected |
| Protocol | TLS 1.2 or 1.3 only | Older protocols are deprecated |
With certificate lifetimes shrinking (a 200-day maximum since March 2026, falling to 100 days from March 2027), the expiry date now changes several times a year, so what matters most is that renewal is automatic.
How do I check an SSL certificate in my browser?
Chrome or Edge (desktop):
- Open the site with
https://. - Click the icon to the left of the address (Chrome shows a "site settings" icon rather than a padlock).
- Choose Connection is secure, then Certificate is valid.
- The viewer shows Issued to, Issued by and the validity dates. The Details tab lists the Subject Alternative Names and the chain.
Firefox: click the padlock, then Connection secure > More information > View Certificate. Firefox opens a page showing every certificate in the chain side by side.
Safari: click the padlock, then Show Certificate.
The browser check is quick but limited: browsers cache intermediates and can fetch missing ones, so a chain problem may not show up on your own computer even when it breaks for others.
How do I check an SSL certificate with OpenSSL?
On macOS, Linux or Windows (via WSL or Git Bash), this prints the essentials:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -dates -ext subjectAltName
You'll see notBefore and notAfter dates, the issuer, and every hostname covered. Always include -servername; without it, servers hosting several sites may return the wrong certificate.
To check whether the certificate expires within the next 30 days (2,592,000 seconds):
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -checkend 2592000
It prints "Certificate will not expire" or "Certificate will expire", and returns a non-zero exit code in the second case, which makes it easy to drop into a scheduled script.
How do I check the certificate chain?
Show every certificate the server sends:
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null
Read the Certificate chain section. Entry 0 is your site's certificate; entry 1 should be the intermediate whose subject matches entry 0's issuer. Near the end, Verify return code: 0 (ok) means OpenSSL could build a trusted chain. Codes such as 21 (unable to verify the first certificate) usually mean the intermediate is missing.
The fix for a missing intermediate is to install the full chain file your CA or ACME client provides (Certbot calls it fullchain.pem) rather than the certificate alone. In Nginx, point ssl_certificate at the full chain:
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
You don't need to send the root certificate; browsers already have it. Reload the web server after changing the file (sudo nginx -t && sudo systemctl reload nginx), then run the -showcerts command again to confirm two certificates now appear and the verify code is 0.
On cPanel hosting, AutoSSL installs the chain for you. If you uploaded a commercial certificate by hand in SSL/TLS > Manage SSL sites, paste the CA bundle (sometimes called the intermediate or CABUNDLE) into its own box; leaving it empty is the most common cause of chain errors on shared hosting.
How do I check an SSL certificate online?
Online checkers test from outside your network, so they catch chain and hostname problems your browser hides. MakeItFlow has a free SSL checker that shows the expiry date, issuer, hostnames and chain for any domain, and its website security scan checks the certificate alongside the HTTPS redirect, HSTS and other security headers.
For a deep protocol and cipher review, Qualys SSL Labs' server test remains a widely used option.
You can also search Certificate Transparency logs, for example at crt.sh, to see every certificate publicly issued for your domain. It's a good way to spot forgotten subdomains, or certificates you didn't request.
How do I monitor SSL expiry so it never catches me out?
Let's Encrypt stopped sending expiry reminder emails in June 2025, and many commercial CAs only email the original purchaser. Don't rely on email.
- Automate renewal with your host's AutoSSL, Certbot or your CDN.
- Check renewal works with
certbot renew --dry-run, or by confirming cPanel's SSL/TLS Status shows recent AutoSSL runs. - Monitor independently. Use an external check that alerts you if the certificate is within, say, 14 to 21 days of expiry. Paid MakeItFlow plans re-scan on a schedule and email you a report, so an expiring certificate shows up well before the deadline.
- Cover every hostname, including
mail.,shop.and API subdomains.
What to do next
Run the OpenSSL one-liner or the free SSL checker against your main domain and each subdomain now, and note the expiry dates and issuers. If anything is close to expiry, missing a hostname or failing the chain check, fix it today. Our guide to SSL certificate errors explains each browser warning, and SSL certificate lifetime changes explains why renewal automation can't wait.
Frequently asked questions
How do I check when my SSL certificate expires?
Click the icon beside the address bar and open the certificate viewer, or run the OpenSSL command above and read notAfter. Both show the exact date and time in UTC.
Why does my certificate work on my computer but not my phone?
Usually a missing intermediate certificate. Desktop browsers often fill the gap from cache; mobile apps and some devices don't. Install the full chain and re-test with -showcerts.
Can I check an SSL certificate for a mail server?
Yes. Use openssl s_client -connect mail.example.com:465 for SMTPS, or add -starttls smtp with port 587 or 25. The same fields apply.
What does "certificate name mismatch" mean?
The hostname in the address bar isn't listed in the certificate's Subject Alternative Names. Reissue the certificate to include it, commonly the www or bare-domain version.
Does the issuer affect how secure my certificate is?
Not for encryption. Any publicly trusted CA provides the same TLS protection. A CAA record lets you restrict which CAs may issue for your domain.
Related reading
- TLS 1.0 and 1.1: How to Check Your Server and Disable Them: Check which TLS versions your server accepts, find out who still uses old ones, then disable TLS 1.0 and 1.1 on Apache, Nginx, IIS, cPanel and Cloudflare.
Sources
More guides for your industry
Free checklist (PDF)
Free hotels & b&bs website checklist
28 practical checks for hotels & b&bs: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 25 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
