How to Check an SSL Certificate: What It Shows and Why It Matters
SSL certificates are the backbone of secure web communication — but most people never look at them directly. Whether you're troubleshooting a browser warning, verifying a site before entering payment details, or managing a server, knowing how to check an SSL certificate is a practical skill that takes less than a minute once you know where to look.
What an SSL Certificate Actually Is
An SSL/TLS certificate is a small digital file installed on a web server that does two things: it encrypts data traveling between the server and your browser, and it verifies the identity of the site you're connecting to. When a site uses HTTPS (rather than HTTP), it has an active SSL certificate in place.
The certificate contains specific information: who it was issued to, who issued it (the Certificate Authority, or CA), what domains it covers, and when it expires. Checking that information is how you confirm a site is legitimate — or catch when something is wrong.
How to Check an SSL Certificate in a Browser 🔒
The most accessible method requires no tools or technical background.
In Chrome, Firefox, Edge, or Safari:
- Navigate to the website you want to check
- Look for the padlock icon in the address bar (or a warning icon if there's a problem)
- Click the padlock
- Select "Connection is secure" or "Certificate is valid" depending on your browser
- Click through to view the full certificate details
What you'll see includes:
- Issued to — the domain or organization the certificate covers
- Issued by — the Certificate Authority (e.g., DigiCert, Let's Encrypt, Sectigo)
- Valid from / Valid to — the active date range
- Certificate type — more on this below
If the padlock is missing, replaced by a warning triangle, or the URL shows "Not Secure," the certificate is either missing, expired, or mismatched with the domain.
Checking SSL Certificates via Online Tools
For a more detailed read — especially useful for site owners and developers — several free web-based tools decode and display SSL certificate data in full.
Common tools in this category include SSL checkers that accept a domain name and return the full certificate chain, expiration date, issuer details, and any configuration issues like mixed content warnings or incomplete certificate chains.
These tools are especially useful for catching problems that browsers hide from end users, such as:
- A certificate that's valid but issued to the wrong subdomain
- An intermediate certificate that isn't properly installed
- A root CA that isn't widely trusted across all devices
Checking SSL Certificates from the Command Line
For developers and sysadmins, the command line offers direct, scriptable access to certificate data.
Using OpenSSL (Linux, macOS, Windows with OpenSSL installed):
This outputs the full certificate chain in real time. To extract just the certificate details:
This returns the subject (who it's issued to), issuer, and validity dates — useful for automated monitoring or scripting certificate expiry alerts.
Using curl:
The -v flag outputs verbose connection data including TLS handshake and certificate information.
Understanding Certificate Types 🛡️
Not all SSL certificates offer the same level of identity verification. The type affects what you see in the certificate details and what it means.
| Certificate Type | What Gets Verified | Typical Use Case |
|---|---|---|
| Domain Validation (DV) | Domain ownership only | Blogs, small sites |
| Organization Validation (OV) | Domain + organization identity | Business websites |
| Extended Validation (EV) | Thorough legal/org verification | Banks, enterprise sites |
| Wildcard | One cert covers all subdomains | Large multi-subdomain setups |
| Multi-domain (SAN) | Covers multiple distinct domains | Hosting multiple properties |
A DV certificate means the site controls that domain — it doesn't mean the organization behind it has been vetted. An EV certificate means a CA has verified the legal entity. Neither type guarantees a site is trustworthy in a broader sense, but the distinction matters when you're assessing how much identity verification was done.
What to Look For When Checking a Certificate
When you pull up certificate details, a few things deserve close attention:
- Expiration date — certificates expire, typically after 1–2 years (and increasingly after 90 days with some CAs). An expired cert causes browser warnings and breaks encrypted connections.
- Domain match — the certificate must match the domain you're visiting. A certificate issued to shop.example.com doesn't cover www.example.com unless it's a wildcard or SAN cert.
- Certificate chain — a valid end-entity certificate needs to chain back to a trusted root CA. Breaks in this chain cause errors even when the cert itself is valid.
- Issuer reputation — certificates from well-known CAs (DigiCert, Sectigo, GlobalSign, Let's Encrypt) are trusted by default in all major browsers. Self-signed certificates are not.
The Variables That Change What You're Checking For
What "checking an SSL certificate" means in practice depends significantly on your role and purpose:
- End users checking a site before submitting personal information mostly need to confirm the padlock is present, the domain matches, and the certificate hasn't expired
- Website owners need to monitor expiration proactively and verify the full chain is correctly installed across all servers
- Developers and DevOps teams often need to validate certificates programmatically, check cipher suites, and confirm TLS protocol versions (TLS 1.2 vs 1.3) are correctly configured
- Security professionals may go deeper into certificate transparency logs, checking whether unauthorized certificates have been issued for their domains
The depth of the check — and the tools best suited for it — shifts meaningfully depending on what you're trying to confirm and the environment you're working in.