How to check an SSL certificate's expiry and validity

Few outages are as sudden or as embarrassing as an expired SSL certificate. One minute your site is fine; the next, every visitor sees a full-page browser warning and bounces. The good news: certificate problems are entirely preventable if you know how to check expiry and validity. Here's how, from three angles.

What "valid" actually means

A certificate being valid is more than just "not expired." A browser accepts a certificate only when all of these hold:

• Not expired and already started — the current time is between the Not Before and Not After dates.
• Name matches — the certificate covers the exact hostname you visited (via its Common Name or, more importantly, its Subject Alternative Names).
• Trusted issuer — it chains up to a Certificate Authority the browser trusts.
• Complete chain — the server sends the intermediate certificates that link your cert to the trusted root. A missing intermediate is the classic "works in my browser but fails elsewhere" bug.
• Not revoked — the CA hasn't invalidated it.

An expiry check alone can miss the last three. Check all of them.

Checking in the browser

Click the padlock in the address bar, then "Connection is secure" → "Certificate." You'll see the issuer, the validity dates, and the covered hostnames. Fast, but it only tells you about the chain your browser happens to trust — it can hide a missing intermediate that other clients will reject.

Checking from the command line with openssl

The definitive local check. To see the expiry dates:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

That prints notBefore and notAfter. For the full picture — issuer, subject, and all SANs:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -subject -ext subjectAltName

The -servername flag is important: it sends SNI so the server returns the right certificate on hosts serving many domains.

To verify the chain is complete, add -showcerts and confirm the intermediates are present:

openssl s_client -connect example.com:443 -servername example.com -showcerts

If openssl reports "unable to get local issuer certificate," you're missing an intermediate — fix the server to send the full chain.

Checking online (no tools installed)

You don't always have openssl handy, and browsers hide chain problems. An online SSL checker connects to the host and reports the expiry date, the issuer, the covered names, the full chain, and the days remaining — all at once. It's the quickest way to confirm a freshly issued certificate is serving correctly to the outside world, not just to your own machine's trust store.

The real fix: never let it expire

Manual renewals are how certificates expire — someone forgets. The answer is automation:

• Let's Encrypt + Certbot issues free 90-day certificates and renews them automatically:

sudo certbot renew --dry-run

The dry run confirms renewals will succeed. Certbot installs a timer that renews well before expiry.

• Control panels (CyberPanel, cPanel, Plesk) issue and auto-renew Let's Encrypt certs for you with a click.
• Monitoring — set a calendar reminder or an uptime monitor that alerts weeks before notAfter, as a backstop even when automation is in place.

Common certificate errors and what they mean

• NET::ERR_CERT_DATE_INVALID — expired or not yet valid. Check the dates; renew.
• NET::ERR_CERT_COMMON_NAME_INVALID — the hostname isn't covered by the cert's SANs. Reissue for the right names.
• NET::ERR_CERT_AUTHORITY_INVALID — untrusted issuer or, very often, a missing intermediate. Send the full chain.
• Mixed content warnings — the cert is fine, but the page loads some assets over http://. Fix the URLs.

Check any certificate now

Run our free SSL checker at /tools/ssl-checker on any domain to see its expiry date, days remaining, issuer, covered hostnames and full chain in one view. Use it right after issuing a certificate to confirm it's serving correctly, and any time a browser throws a warning you want to diagnose.

Hosting the site yourself? On a Nxeon VPS you have full root to run Certbot and set up auto-renewing HTTPS in minutes — or pick a one-click control-panel image that handles SSL for you. See /vps.