How to check an SSL certificate

What you are actually checking

• Expiry date. Certificates have a hard end date. Most are now issued for about a year or less (Let's Encrypt uses 90 days), so "we set it up once" quietly becomes "it expired last Tuesday."
• Issuer. Who vouched for the site — Let's Encrypt, DigiCert, Sectigo, and so on. An issuer you don't recognize on your own site is worth a question.
• Hostname match. The certificate lists the names it covers (the Subject Alternative Names). If your site answers on a name that isn't listed, browsers reject it.
• The chain. Your certificate links to an intermediate certificate, which links to a root that browsers trust. A missing intermediate is the classic "works on my laptop, broken on phones" failure.
• Protocol support. Modern servers should offer TLS 1.2 and 1.3 and refuse the long-broken SSLv3, TLS 1.0, and TLS 1.1.

Method 1: your browser

1. Open the site over HTTPS and click the padlock (or tune icon) in the address bar.
2. Choose "Connection is secure," then "More information" or "Certificate details" — the exact labels vary between Chrome, Firefox, and Safari.
3. Read the validity dates, the issuer, and the list of covered domain names.

This is the fastest sanity check there is. Its limit: the browser only shows you the certificate for the page you are on, and it hides most chain and protocol detail.

Method 2: one openssl command

For the full picture from any Mac or Linux terminal, ask the server for its certificate directly:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subject -ext subjectAltName

That prints:

notBefore=Sep  3 00:00:00 2026 GMT
notAfter=Dec  2 23:59:59 2026 GMT
issuer=C = US, O = Let's Encrypt, CN = R12
subject=CN = example.com
X509v3 Subject Alternative Name:
    DNS:example.com, DNS:www.example.com

• notAfter is the expiry. Anything under 30 days out deserves a renewal now; under 7 is an emergency with a calendar invite.
• The -servername flag matters: it sends SNI, so servers that host many sites return the right certificate. Skip it and you may inspect a default certificate the site doesn't actually serve to visitors.
• Run the same command without piping to openssl x509 and scroll the top of the output: "Verify return code: 0 (ok)" means the chain validated. A code like 21, "unable to verify the first certificate," usually means the server is not sending its intermediate certificate.

A quicker variant: curl -vI https://example.com prints the certificate's dates and a "SSL certificate verify ok" line (or the exact reason verification failed) in the handshake output.

Method 3: get a grade

Dates and names are the basics; a full assessment also grades protocol versions, cipher strength, and known vulnerabilities (the Heartbleed and POODLE era attacks are still tested for). That is a bigger job than a terminal command — dedicated scanners probe the server dozens of ways and roll it up into a letter grade. An A or A+ is a healthy server. Anything at B or below usually traces back to an old protocol still enabled or a chain problem, both fixable in server config.

The automated way

For a fast fact check, the PapaCasper MCP Toolbelt's ssl_cert_checktool connects to a host and returns the expiry date, days remaining, issuer, and subject as JSON for $0.01 per call — handy inside an agent workflow or a monitoring script, with no signup or API key. When you want the full assessment,ssl_labs_grade ($0.10) returns the letter grade with protocol, cipher, chain, and vulnerability detail behind it.