How to check an SSL certificate: browser, command line and online

To check an SSL certificate is to confirm that the certificate a site serves is valid for its name, is within its dates, and chains to a trusted root. You can do it in a browser for a quick look, from the command line for an exact answer, or with an online test that also grades the server's TLS settings. This page shows all three, what to look for, and how to find the certificate on your own server. It is part of the certificates section.

Quick facts

Fastest

the browser's certificate viewer

Most precise

openssl s_client from a machine other than the server

Most complete

an online server test, which also checks protocols and the chain

What to confirm

dates, names, chain, issuer

Do it

after every installation or renewal, and on a schedule

What to check

Whatever tool you use, four things decide whether visitors connect without a warning:

1. Dates. The current date is between the certificate's start and end dates. A certificate close to its end date needs renewal now; see renewal.

2. Names. Every hostname visitors use, including the bare domain and www, is listed in the Subject Alternative Name. See Subject Alternative Names.

3. Chain. The server sends its own certificate and the intermediates, and the chain ends at a root clients trust. See certificate chains.

4. Issuer. The certificate comes from the SSL certificate authority you expect. An unexpected issuer can mean a proxy is intercepting the connection, or that someone else obtained a certificate for your name.

The protocol versions the server accepts matter too, but they are a property of the server, not the certificate; see TLS versions.

Check a certificate in the browser

• Chrome and Edge. Click the icon to the left of the address, choose Connection is secure, then Certificate is valid. The viewer shows the names, the issuer, the dates and, under the details tab, every field and the chain.

• Firefox. Click the padlock, choose Connection secure, then More information, and View Certificate. Firefox shows each certificate in the chain on its own tab.

• Safari on a Mac. Click the padlock in the address bar and choose Show Certificate.

• Safari on iPhone and iPad. There is no certificate viewer. Check from a computer, or use an online test.

A browser check has one blind spot: browsers fill in missing intermediates from their cache, so a chain that works in your browser can still fail for other visitors and for apps. Confirm the chain with one of the methods below.

Check from the command line

From any machine with OpenSSL, against the hostname visitors use:

$ openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

That prints the names, issuer and dates of the certificate the server actually sends. To check the chain, run s_client with -showcerts and read the result at the end of the output: Verify return code: 0 (ok) means the chain is complete and trusted. Other codes, and what each one means, are explained alongside the OpenSSL commands to verify a certificate.

curl gives a quick yes or no, with the certificate details in its verbose output:

$ curl -vI https://example.com/

A certificate problem makes curl stop with an error such as SSL certificate problem: unable to get local issuer certificate; see unable to get local issuer certificate.

Check with an online test

An online server test connects from outside your network, so it sees what visitors see. It reports the certificate, the chain the server sends, the protocol versions and ciphers it accepts, and known configuration problems. The Qualys SSL Labs Server Test is a widely used free example, and it grades the result.

Use an online test after the first installation and after configuration changes. For a quick check after each renewal, the command line is faster.

Find the certificate on your server

Sometimes the question is not whether the certificate is valid, but which file the server uses.

• nginx. The ssl_certificate directive in the site's server block names the file. See installing on nginx.

• Apache. SSLCertificateFile in the virtual host on port 443. See installing on Apache.

• IIS. Certificates are in the Windows store, not in files; the site's https binding shows which one is used. See installing on IIS.

• Certbot. certbot certificates lists every certificate it manages, with names, expiry dates and file paths, usually under /etc/letsencrypt/live/.

Then compare the file with what the server sends. If they differ, the server has not been reloaded, or something in front of it, such as a load balancer or CDN, serves its own certificate.

Check expiry automatically

A one-off check finds today's problem. Expiry is a dated problem, and certificates are now replaced every few months, so the check belongs on a schedule. The OpenSSL option -checkend turns it into a yes-or-no answer for scripts:

$ openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -checkend 1209600

The command exits with status 1 if the certificate expires within 14 days. Run it from outside the server, separately from whatever renews the certificate, so that a failed renewal is caught before visitors see it.

FAQ