SEO check

How to Check SSL Certificate: Test, Read and Fix Results

Check any site's SSL certificate in the browser, with OpenSSL or with our free report, then read the result and fix what fails.

Check my website Jump to the fix

Free to use 6 min read Updated Oct 2026

How to check an SSL certificate in one minute

Quick answer: To check an SSL certificate, confirm three things: a trusted authority signed it, it names the exact host you typed, and its expiry date has not passed. The padlock menu, one OpenSSL command and the SSL certificate checker row in our free report each show how to check SSL certificate status.

Pass: Trusted, matching the host name, with at least one full day left.
Fail: Untrusted, issued to another name, expired, or nothing answers on port 443.
Fix: Renew it, reinstall it with the full chain, or fix the host name.

Check my website

How to check an SSL certificate in your browser

The browser is the fastest way to check SSL certificate details, and it needs no tools. Menu wording shifts between versions, so look for the connection is secure entry, then view the certificate.

Open site details. In Chrome and Edge, click the icon beside the address bar. In Firefox choose Connection secure, More information, View Certificate. In Safari, click the padlock, then Show Certificate.
Read three fields. Issued to must match the address you typed, issued by should name a known certificate authority, and Valid to is the expiry date.

Developers can also use the Chrome DevTools security panel, which has a View certificate button. Mixed content can break it too.

How to check an SSL certificate with OpenSSL

From a terminal, how to check SSL certificate dates comes down to one command that works for any host, in Linux, WSL or Git Bash.

Text

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

The output lists notBefore and notAfter in GMT. The notAfter value is the expiration date, so days left is the gap to today. The -servername flag sends the host name through Server Name Indication (SNI), so shared servers return yours.

For a yes or no answer, replace -dates with -checkend 2592000 (30 days in seconds). The exit code is 0 if the certificate outlasts that window and 1 if not, so a cron job can act on it.

Dates say nothing about trust, because the OpenSSL s_client manual notes that s_client accepts any chain. Add -verify_hostname example.com and read the Verify return code line: 0 (ok) is a pass, and any other number names the failure, such as 10 for expired or 62 for a host name mismatch. Adding -showcerts lists what the server sent, which is not proof the chain is valid.

How SEO Site Checker tests your SSL certificate

The SSL Checker and HTTPS Test row of the free SEO report is how to check SSL certificate status without a terminal, and it sets the Secured or Not Secured card.

The rule: We connect to your host on port 443 with a 3 second limit, send the host name, and require a trusted chain and a matching name.

This SSL test applies the same core verification a browser does, minus extras. A browser may fetch a missing intermediate from an address inside the certificate and our check cannot, so it can fail a site that shows a padlock. Port 443 is tested whatever scheme you typed, so http entries can pass.

Pass: The handshake verifies and at least one full day remains. The card turns green and prints the TLS version and expiry date.
Fail: Nothing answers on 443, or the certificate is self signed, untrusted, expired, mismatched, missing an intermediate or within a day of expiry. One red message covers every cause, so use the manual checks above.
Not tested: Revocation, ciphers, minimum TLS version and the redirect. HSTS and mixed content have their own cards.

How to read an SSL check result

Visitors see these as a full page warning such as Your connection is not private, and the error names below are Chrome's. For the concept, read how HTTPS encryption works.

What you see	What it means	First thing to try
Expired SSL certificate, NET::ERR_CERT_DATE_INVALID	The Valid to date is in the past.	Renew it, install it and reload the web server.
Host name mismatch, ERR_CERT_COMMON_NAME_INVALID	The certificate names other hosts.	Check the Subject Alternative Name (SAN) list for your exact host, including www.
Self signed certificate, NET::ERR_CERT_AUTHORITY_INVALID	No public authority signed it.	Replace it with one from a trusted authority.
Incomplete chain	The server did not send the intermediate.	Install the full chain file.
No answer on port 443	The port is closed, a firewall blocks it, or HTTPS was never set up.	Open the port or enable HTTPS. If the IP is wrong, try a DNS record lookup.

How to fix a failed SSL certificate check

Renew or reissue. Once the table names the cause, install a fresh certificate and its chain on the server that really answers, which the hosting checker can identify.
Reload and test. Reload the web server, repeat the verify command until it prints 0 (ok), then run the report again.
Automate renewal. Set up auto renewal with certbot or your host's tool. Let's Encrypt ended its expiry emails (read the Let's Encrypt expiry email notice), so nothing warns you.
Finish up. Then add the HTTP to HTTPS redirect and HSTS.

Mistakes to avoid when checking SSL

A padlock on your laptop only proves your browser trusted the certificate. A phone on mobile data can reach a different server or CDN edge and get an expired one. Test the bare domain and www separately, because one may be covered and not the other.

A CDN such as Cloudflare may show visitors a different certificate from your origin, so check both. Renewing the file does not renew the site, because Apache and Nginx serve the old one until reloaded. A pass is not an audit, and the SSL and rankings guide covers the search side.

How to Fix

The short version, the same steps you see when you click How to Fix in your report.

Why this fails: Our check connected to port 443 and could not confirm a trusted, matching and unexpired certificate. Browsers show a full page warning for most of the same problems, and many visitors leave. The usual causes are an expired certificate, the wrong host name, a self signed certificate, a missing intermediate or a closed port 443.

How to fix it:

Run the first command below, replacing example.com with your own domain everywhere it appears, and compare the dates with today.
Run the second command. A result of 0 (ok) means the chain and name verified, while another code points to the cause.
Renew or reissue the certificate with both the bare domain and the www version listed, then install it together with its intermediate chain.
Confirm the web server listens on port 443 and the firewall allows it.
Reload the web server so it picks up the new files.
Turn on automatic renewal. Certbot users can rehearse it with the third command.

Text

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates
echo | openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com 2>/dev/null | grep "Verify return code"
sudo certbot renew --dry-run

WordPress or shared hosting: use the SSL or Let's Encrypt tool in the hosting control panel.
Apache: point SSLCertificateFile at the full chain file and SSLCertificateKeyFile at the key, then run sudo apachectl graceful.
Nginx: point ssl_certificate at fullchain.pem and ssl_certificate_key at the key, then run sudo systemctl reload nginx.
Cloudflare: install a valid certificate on the origin server, then set the SSL mode to Full (strict). A Flexible mode can hide an origin problem.

Re-test: Repeat the verify command or run our free report again, and confirm the SSL card is green with an expiry date at least a few weeks away. The dates alone don't prove trust, so look for 0 (ok) as well. Then read the HTTPS encryption guide for the next step.

Re-test my website

Frequently Asked Questions

How do I check the SSL certificate of a website?

Click the icon next to the address, open the certificate details and read Issued to, Issued by and Valid to. For a deeper look, run one OpenSSL command or use our free report.

How do I check the expiration date of an SSL certificate?

Read Valid to in the browser certificate viewer, or print notAfter with openssl x509 and the enddate option, which shows it in GMT. Our report shows the expiry date on the SSL card when the check passes.

How do I check an SSL certificate with OpenSSL?

Run openssl s_client with the host on port 443 and the servername flag, then pipe the output into openssl x509 with the dates option. Servername matters because shared servers pick the certificate by host name.

How can I tell if an SSL certificate is valid?

A valid certificate is signed by a trusted authority, issued to your exact host name and not expired. If any one fails, browsers warn visitors and our report shows Not Secured. OpenSSL confirms all three with Verify return code 0 (ok).

How do I check the SSL certificate chain?

Run openssl s_client with showcerts and read the certificates in order: your site first, then the intermediate. This shows only what the server sent, so confirm trust with the Verify return code line too.

What happens when an SSL certificate expires?

Browsers show a full page warning, many visitors leave, and API clients refuse the connection. Crawlers and other automated clients that cannot verify the certificate may fail to fetch pages until you renew it and reload the server.

How often should I check my SSL certificate?

Check after every renewal or server change, and again each month as a backstop to automatic renewal. Certificate lifetimes are shrinking, so renewals come more often than they did a few years ago.

See how your site scores right now

Paste your address into the free report, then use the How to Fix button on anything that needs work.

Check my website Browse all SEO checks

Free to use. Results in under a minute for most sites.