Home >Blog
How to Decode SSL Certificates and Check Details
Published Updated
SSL certificate fields
Check the hostname first
A certificate may be valid for one hostname and wrong for another.
Use SNI
The -servername flag matters on shared servers.
Read SAN and dates
Modern hostname validation uses SAN entries and the validity window.
按顺序完成
- Connect to the host. Use the exact public hostname and port 443.
- Pipe the certificate. Send the output into openssl x509 for fields and extensions.
- Compare with the server. If the wrong certificate appears, inspect SNI or the TLS-terminating proxy.
- Separate failure types. Hostname mismatch, expired dates, and missing intermediates are different fixes.
FAQ
Is common name enough?
No. Check SAN entries.
Why is OpenSSL showing another certificate?
The server may need SNI or a proxy may terminate TLS.
Can a valid certificate still fail?
Yes. Hostname, chain, or signature support may still be wrong.
FAQ
Is common name enough?
No. Check SAN entries.
Why is OpenSSL showing another certificate?
The server may need SNI or a proxy may terminate TLS.
Can a valid certificate still fail?
Yes. Hostname, chain, or signature support may still be wrong.
