How to Check SSL Certificates

Domain name

Which domain (or domains) the certificate covers

Issuer

The Certificate Authority (CA) that issued it — e.g. Let's Encrypt, DigiCert, Cloudflare, Sectigo

Validity period

The "Not Before" and "Not After" dates — certificates typically last 90 days (Let's Encrypt) or 1 year (paid CAs)

Certificate chain

The chain of trust from your certificate up to a trusted root CA. If any link is missing, browsers won't trust it.

Public key

Used to encrypt the initial connection between the browser and server

1. DNSFly SSL Checker (quickest)

Go to DNSFly SSL Checker, enter a domain, and you'll see:

• • Whether the certificate is valid
• • Issuer and subject (who issued it and for which domain)
• • Expiry date and days remaining
• • Certificate chain (root → intermediate → leaf)
• • Protocol and cipher information

2. Browser padlock

Click the padlock icon in your browser's address bar. In Chrome, click "Connection is secure" → "Certificate is valid" to see full details including the expiry date and issuer.

Limitation: You can only check sites you're currently visiting.

3. Command line

For developers and sysadmins:

# Check SSL certificate for a domain
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

# Output:
notBefore=Jan  1 00:00:00 2026 GMT
notAfter=Apr  1 00:00:00 2026 GMT

# See full certificate details
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text

Certificate expired

The most common issue. Browsers show "Your connection is not private" and most visitors will leave.

Fix: Renew your certificate. If you use Let's Encrypt, check that your auto-renewal cron job or certbot timer is running. If you're on Cloudflare or a managed host, renewal should be automatic — contact support if it isn't.

Domain name mismatch

The certificate was issued for www.example.com but you're visiting example.com (or vice versa). Browsers treat these as different domains.

Fix: Get a certificate that covers both. Most CAs include both the bare domain and www variant. Alternatively, use a wildcard certificate (*.example.com) which covers all subdomains.

Incomplete certificate chain

Your server sends the leaf certificate but not the intermediate certificate(s). Most desktop browsers can figure it out, but mobile browsers and API clients often can't — resulting in trust errors.

Fix: Configure your web server to send the full chain. Your CA provides intermediate certificates — concatenate them with your leaf certificate in the correct order.

Mixed content warnings

Your page loads over HTTPS, but some resources (images, scripts, stylesheets) are still loaded over HTTP. Browsers may block these resources or show warnings.

Fix: Update all resource URLs to use https:// or protocol-relative URLs (//). Check your HTML, CSS, and database for hardcoded http:// links.

Self-signed certificate

The certificate wasn't issued by a trusted CA. Common on development servers, but browsers will show a warning on production sites.

Fix: Replace with a certificate from a trusted CA. Let's Encrypt is free and takes minutes to set up. There's no reason to use self-signed certificates in production.

Enable auto-renewal

Let's Encrypt certificates expire every 90 days. Use certbot or your hosting provider's auto-renewal to avoid manual work. Most managed platforms (Cloudflare, Vercel, Netlify) handle this automatically.

Force HTTPS with HSTS

Add the Strict-Transport-Security HTTP header to tell browsers to always use HTTPS. This prevents downgrade attacks where an attacker forces the browser to use HTTP.

Use TLS 1.2 or 1.3

Disable TLS 1.0 and 1.1 — they have known vulnerabilities. TLS 1.3 is fastest and most secure. All modern browsers support TLS 1.2+.

Redirect HTTP to HTTPS

Set up a 301 redirect from http:// to https:// so visitors and search engines always reach the secure version. This also consolidates your SEO signals to one URL.

Monitor expiry dates

Even with auto-renewal, things can break. Set up a monitoring service (or bookmark DNSFly's SSL Checker) and check your certificate periodically.