How to Check an SSL Certificate on a Server: 4 Methods
Why Bother Checking?
Certificates expire. Domains change. SAN entries get dropped during renewal. Knowing how to look at what's actually installed on your server saves you from those 3 AM outage alerts.
Method 1: Browser Developer Tools
The quickest way for a single site. Click the padlock icon in the address bar, then navigate to the certificate details. You'll see the issuer, validity period, and SAN list right there. Not great for automation, but perfect for a quick sanity check.
Method 2: OpenSSL s_client
This is the one I use most. From any terminal:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject -issuer
It shows you exactly what the server presents, including the certificate chain. The -servername flag matters for virtual hosts — without it you might get the default certificate instead of the one you're asking about.
Method 3: curl -v
If you just need to verify the connection works and see the handshake, curl -vI https://example.com gives you the TLS info along with the response headers. Less detail than OpenSSL, but faster when you're already in the terminal.
Method 4: Online Decoders
Paste your certificate PEM into an online decoder and you get a clean breakdown of every field — extensions, key usage, transparency logs. I use this when I need to share certificate details with someone who doesn't want to read raw PEM output.
What to Look For
Don't just check the expiry date. Verify the SAN covers all your subdomains, confirm the issuer matches what you expect, and make sure the chain is complete (browsers are forgiving here, but some clients aren't).
