How to Check an SSL Certificate: Expiry, Issuer, and Validity

The padlock in your address bar rests on a TLS certificate, still widely called an SSL certificate. It does two jobs at once. First, it encrypts traffic between your browser and the server so no one in between can read it. Second, it vouches for identity: a trusted certificate authority has confirmed that whoever runs the site actually controls the domain name on the certificate.

Checking a certificate lets you confirm both jobs are being done correctly. A valid, unexpired certificate issued to the right domain by a recognized authority is the technical foundation of a trustworthy connection. A certificate that is expired, self-signed, or issued for the wrong name is a genuine warning sign worth taking seriously.

Four details tell you almost everything. The issuer is the certificate authority that signed the certificate, such as a well known public CA. The validity period gives the start and expiry dates; browsers reject certificates that are expired or not yet valid. The subject and its subject alternative names list every hostname the certificate legitimately covers. The expiry countdown matters most for site owners, because a certificate that lapses will break the site for every visitor at once.

Pay attention to the covered names in particular. A certificate issued for one domain does not automatically cover its subdomains unless it is a wildcard or explicitly lists them. A name mismatch is one of the most common reasons a browser throws a security warning even when the certificate itself is otherwise valid.

You do not need command line tools to inspect a certificate. An online SSL checker connects to the host on the secure port, retrieves the certificate the server presents, and lays out the important fields in plain language.

To read a certificate, the tool has to open a real connection to the server, so the hostname you enter is sent to our service, which performs the TLS handshake and reports back what the server presented. This is the same public certificate any visitor receives, so nothing private is exposed. The check reads the certificate only; it does not send credentials or load private pages.

For site owners, the most useful habit is checking the expiry countdown well ahead of the deadline. Automated renewal has made lapsed certificates rarer, but automation still fails quietly, and a certificate that expires overnight takes the whole site down until it is replaced. A periodic manual check is cheap insurance.