How to Check SSL Certificate Status
Knowing how to check SSL certificate status helps you prevent browser warnings, protect user trust, and avoid unexpected downtime.
The process is straightforward, but the details matter if you want to verify expiration, issuer, chain validity, and revocation signals accurately.
An SSL/TLS certificate does more than enable HTTPS.
It confirms identity through a public key infrastructure model built around certificate authorities, trust stores, and validation rules that browsers and operating systems enforce in real time.
What SSL certificate status actually means
SSL certificate status is not just “valid” or “invalid.” It usually refers to a combination of checks that determine whether a certificate is currently trustworthy for a specific hostname and use case.
- Validity period: whether the certificate is within its Not Before and Not After dates.
- Hostname match: whether the certificate covers the domain or subdomain being visited.
- Trust chain: whether the issuing certificate authority can be validated back to a trusted root.
- Revocation state: whether the certificate has been revoked via OCSP or CRL.
- Configuration quality: whether the server presents the right intermediate certificates and uses modern TLS settings.
A certificate can be installed yet still fail one of these checks.
That is why a practical status review looks beyond the padlock icon.
How to check SSL certificate status in a browser
The fastest way to inspect SSL status is through your browser’s security details.
This is useful for a quick check, especially when you need to see whether the certificate is serving correctly on the public site.
Chrome and Chromium-based browsers
Open the site, click the padlock or site information icon, then inspect the connection details.
Look for certificate subject, issuer, validity dates, and any warnings about trust or mixed content.
Firefox
Click the padlock, open connection details, and view the certificate information.
Firefox often provides clear messages when the certificate is expired, self-signed, or issued by an untrusted authority.
Safari
Use the security or certificate details from the address bar and inspect trust status.
On macOS, Safari relies heavily on the system keychain and trust settings.
Browser checks are useful, but they only tell you what the client sees.
For a deeper diagnosis, use command-line tools and online validators.
How to check SSL certificate status with OpenSSL
OpenSSL is one of the most reliable tools for inspecting certificate status directly from a server.
It is widely used by system administrators, DevOps teams, and security engineers because it reveals the certificate presented during the TLS handshake.
To view the certificate chain and expiration details, you can use commands similar to the following:
openssl s_client -connect example.com:443 -servername example.comopenssl x509 -in certificate.crt -noout -dates -issuer -subject
When reviewing the output, focus on these items:
- notBefore and notAfter: confirm the certificate is active and not expired.
- issuer: verify the certificate authority matches expectations.
- subject: confirm the certificate identifies the correct domain.
- Subject Alternative Name: check that the domain and subdomains are included.
- Verify return code: look for a successful chain validation result.
If the server does not send the correct intermediate certificates, browsers may still show an error even if the leaf certificate itself is valid.
How to check SSL certificate status online
Online SSL checkers are helpful when you want a quick external view of your site’s certificate deployment.
They simulate a remote client and report issues with the chain, expiration, cipher configuration, and hostname coverage.
Commonly used services include SSL Labs by Qualys, DigiCert tools, and other public certificate scanners.
These tools typically report:
- Certificate expiration date
- Chain completeness
- Supported TLS versions
- Certificate transparency log presence
- OCSP stapling support
- Weak protocol or cipher settings
SSL Labs is especially useful because it gives a detailed grade and explains deployment problems in plain language.
If you manage multiple domains, it can help you identify misconfigurations before they affect visitors.
How to check SSL certificate status with cURL
cURL can be used to test HTTPS endpoints from the command line and quickly confirm that the certificate is being served as expected.
It is especially helpful in automated environments and CI pipelines.
A simple request like curl -Iv https://example.com will show connection and certificate-related details, including TLS negotiation and any certificate verification problems.
If verification fails, the output often points to a hostname mismatch, expired certificate, or missing intermediate certificate.
For scripted checks, cURL is useful because it can be integrated into cron jobs, monitoring systems, and deployment validation steps.
How to verify certificate expiration and renewal timing
Expiration is one of the most common reasons for SSL outages.
Public certificates now have shorter lifespans than in the past, which makes renewal automation essential for organizations that run production websites, APIs, or email gateways.
When checking status, compare the expiration date with your renewal schedule and alert thresholds.
Many teams use alerts at 30 days, 14 days, and 7 days before expiration.
- 30 days out: verify renewal automation and certificate inventory.
- 14 days out: confirm the new certificate is issued and ready.
- 7 days out: test deployment to staging or production.
- 1 day out: validate the live chain and hostname coverage.
If you use ACME-based automation such as Let’s Encrypt, status checks should confirm both issuance success and actual installation on the web server or load balancer.
What to check beyond expiration
Good certificate status checks go beyond dates.
A certificate can be current yet still broken in production because of deployment or trust issues.
Hostname and Subject Alternative Name coverage
Modern browsers rely on the SAN field rather than the common name alone.
Make sure the certificate covers the exact hostnames users visit, including www, apex domains, and necessary subdomains.
Intermediate certificate chain
Servers must usually present the leaf certificate along with the appropriate intermediates.
If the chain is incomplete, some clients may fail validation even though others succeed.
Revocation checks
Revocation is less visible than expiration but still matters.
OCSP and CRL mechanisms help clients determine whether a certificate should still be trusted after issuance.
Certificate Transparency
Publicly trusted certificates are generally logged in Certificate Transparency logs.
This creates accountability and helps security teams spot unexpected certificate issuance.
How to check SSL certificate status on a server you manage
If you manage the origin server, load balancer, or reverse proxy, check the certificate directly at the edge where users connect.
Nginx, Apache, Microsoft IIS, F5, Cloudflare, and AWS Elastic Load Balancing can all present different certificates depending on where TLS is terminated.
A reliable workflow is:
- Inspect the certificate from a browser and from the command line.
- Confirm the active certificate file or secret on the server.
- Verify the renewal automation or certificate manager.
- Restart or reload the service if the new certificate has not been picked up.
- Re-test from an external network location.
This is especially important in environments with multiple certificates, SNI-based hosting, or layered infrastructure such as CDN plus origin servers.
Common SSL status problems and what they mean
Several recurring errors appear during SSL checks, and each points to a specific issue.
- Certificate expired: the validity period ended and the certificate must be renewed.
- Hostname mismatch: the certificate does not match the requested domain.
- Untrusted issuer: the certificate chain cannot be validated to a trusted root.
- Incomplete chain: one or more intermediate certificates are missing.
- Revoked certificate: the certificate was explicitly invalidated by the issuer.
- Mixed content warnings: the page loads insecure assets even though HTTPS is active.
These issues can affect SEO, conversion rates, and user confidence, especially because browsers increasingly surface security problems prominently.
Best practices for ongoing SSL monitoring
One-time checks are useful, but continuous monitoring is better.
Use automated certificate inventory, alerts, and external probes to keep track of every domain and subdomain that presents a certificate.
- Maintain a central list of all certificates in use.
- Track expiration dates in a monitoring platform.
- Test both public and internal endpoints.
- Validate from multiple regions if you use a CDN or geo-distributed infrastructure.
- Review renewal logs after every deployment.
- Keep DNS, load balancer, and origin configurations synchronized.
For larger organizations, certificate management platforms and CSPM tools can reduce human error by discovering unmanaged certificates and alerting teams before outages occur.
When to escalate certificate issues
Escalate immediately if a certificate warning appears on a live customer-facing service, if a renewal failed, or if you suspect a private key compromise.
In those cases, the issue is not just operational; it may be a security incident that requires reissuance, key rotation, and log review.
If the problem only appears in one browser or on one network, compare the trust store, proxy settings, and server chain configuration before assuming the certificate itself is bad.