A website has SSL when it serves pages over https:// with a certificate that your browser trusts. To check if a website has SSL, look at three things: whether the certificate is valid, who issued it, and when it expires. This guide shows four ways to check an SSL certificate, from a one-click SSL certificate checker to openssl on the command line.
Quick Answer: Enter the domain into a free SSL certificate checker. It connects to the site on port 443 and shows whether the certificate is valid and trusted, the issuer, the expiry date, the hostnames it covers and the full chain. For a quick look without a tool, click the icon left of the address bar and open the certificate details.
What SSL/TLS is
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) encrypt the connection between a browser and a web server. TLS replaced SSL long ago, but people still say "SSL certificate" for the certificate a site uses for TLS.
A valid certificate proves two things. The connection is encrypted, and the server holds a certificate for the domain in the address bar. It does not prove the site is honest. Google's Chrome team notes that nearly all phishing sites use HTTPS too.
HTTPS still matters for every site. Browsers mark plain HTTP pages as "Not Secure", and Google has used HTTPS as a ranking signal since 2014.
Method 1: Use an SSL certificate checker
An SSL certificate checker shows the full certificate without developer tools. Our free SSL checker runs a live TLS handshake with the server and shows:
- Status: valid, expiring (30 days or fewer left), expired, untrusted, or a hostname mismatch
- Issuer: the certificate authority (CA), such as Let's Encrypt, Sectigo or DigiCert
- Common name and organization: the organization field appears only on OV and EV certificates
- TLS protocol: the version the server negotiated, such as TLSv1.3
- Validity: the valid from and valid to dates, and the days left until expiry
- Covered hostnames: every name in the Subject Alternative Name (SAN) list
- Certificate chain: every certificate from the site's own up to the root
- Serial number and fingerprints: SHA-256 and SHA-1
To use it:
- Open the SSL checker.
- Enter a domain, such as
github.com. - Read the status line first. If it says anything other than valid, the banner under it explains the problem.
Try it yourself
Check any website's hosting
Enter a domain or IP to see hosting provider, DNS records, and more.
The same certificate check runs inside the full hosting check, next to the DNS records, IP location and hosting provider. For use in code, the /ssl endpoint of the public API returns the same data as JSON.
Method 2: Check the browser address bar
Every browser shows the connection state left of the address bar. Chrome replaced its padlock with a "tune" icon (two sliders) in Chrome 117, released in September 2023. Firefox still shows a padlock.
| What you see | What it means |
|---|---|
Padlock or tune icon, https:// | The certificate is valid and the connection is encrypted |
| "Not Secure" next to the address | The page loads over plain HTTP, with no encryption |
| Full-page warning such as "Your connection is not private" | The certificate is expired, self-signed, untrusted or for a different hostname |
View the certificate in Chrome
- Click the tune icon left of the address.
- Click Connection is secure.
- Click Certificate is valid.
- The viewer shows the subject, the issuer and the validity dates.
In Firefox, click the padlock, then Connection secure, then More information, then View Certificate. The browser view works for one site. To see the chain, the SAN list and the days left in one place, use the SSL checker.
Method 3: Check an SSL certificate from the command line
openssl and curl ship with macOS and most Linux systems. The output below comes from github.com, checked on 12 October 2026.
openssl s_client
This command prints the subject, issuer, validity dates and covered hostnames:
echo | openssl s_client -connect github.com:443 -servername github.com 2>/dev/null \
| openssl x509 -noout -subject -issuer -dates -ext subjectAltNamesubject=CN=github.com
issuer=C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36
notBefore=Sep 1 00:00:00 2026 GMT
notAfter=Nov 29 23:59:59 2026 GMT
X509v3 Subject Alternative Name:
DNS:github.com, DNS:www.github.com
The certificate covers github.com and www.github.com and expires on 29 November 2026. "DV" in the issuer name means it is a Domain Validation certificate.
To see the chain, the TLS version and whether OpenSSL trusts the certificate, keep the handshake output:
echo | openssl s_client -connect github.com:443 -servername github.com 2>&1 \
| grep -E "depth=|Protocol|Cipher is|Verify return code"depth=2 C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46
depth=1 C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36
depth=0 CN=github.com
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Protocol: TLSv1.3
Verify return code: 0 (ok)
Verify return code: 0 (ok) means the chain leads to a trusted root. Any other code names the problem, for example 10 (certificate has expired).
Always pass -servername. Many servers host several sites on one IP address. They pick the certificate by the hostname the client sends, through Server Name Indication (SNI). Without -servername, you may see a different site's certificate.
curl -vI
curl -vI sends a HEAD request and prints the TLS handshake on the way:
curl -vI https://github.com* Connected to github.com (140.82.121.4) port 443
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* Server certificate:
* subject: CN=github.com
* start date: Sep 1 00:00:00 2026 GMT
* expire date: Nov 29 23:59:59 2026 GMT
* subjectAltName: host "github.com" matched cert's "github.com"
* issuer: C=GB; O=Sectigo Limited; CN=Sectigo Public Server Authentication CA DV E36
* SSL certificate verify ok.
< HTTP/2 200
SSL certificate verify ok and the subjectAltName ... matched line mean the certificate is valid for the hostname. If the certificate has a problem, curl stops before the HTTP response and prints an error. The common SSL errors section shows those errors.
Method 4: Search Certificate Transparency logs
Chrome trusts a public certificate only when it appears in public Certificate Transparency (CT) logs (Chrome CT policy). So CAs log the certificates they issue. crt.sh lets you search those logs by domain.
- Open crt.sh.
- Enter the domain. Use
%.example.comto include subdomains. - Each row lists a certificate, its issuer and its validity dates.
CT logs show every certificate issued for a domain, including expired ones and ones for forgotten subdomains. They do not show which certificate a server uses right now. For that, use Method 1 or Method 3.
SSL certificate types
All certificates encrypt the same way. They differ in what the CA checked about the owner before it issued the certificate.
| Type | What the CA checks | Organization name in the certificate |
|---|---|---|
| DV (Domain Validation) | Control of the domain only | No |
| OV (Organization Validation) | Domain plus the organization's identity and address | Yes |
| EV (Extended Validation) | Domain plus a stricter legal, physical and operational check | Yes, plus jurisdiction and registration number |
The github.com certificate above is DV. Let's Encrypt issues only DV certificates, for free. The guide to SSL certificate types shows a real DV, OV and EV certificate and how to tell them apart.
Common SSL errors and what they mean
The examples below use test sites from badssl.com, which keeps broken certificates online on purpose.
Expired certificate
$ curl -I https://expired.badssl.com
curl: (60) SSL certificate problem: certificate has expired
The "valid to" date has passed. Browsers block the page with a full-page warning. Renew the certificate and set up automatic renewal, for example with Certbot or your host's built-in renewal.
Self-signed certificate
$ curl -I https://self-signed.badssl.com
curl: (60) SSL certificate problem: self signed certificate
The server owner created the certificate, not a trusted CA. A self-signed certificate is fine on a development machine and never on a public site.
Hostname mismatch
$ curl -I https://wrong.host.badssl.com
curl: (60) SSL: no alternative certificate subject name matches target host name 'wrong.host.badssl.com'
The hostname you visited is not in the certificate's SAN list. A common cause is a certificate for www.example.com that does not list the bare example.com.
Mixed content
The page loads over HTTPS, but some images, scripts or stylesheets load over plain HTTP. Browsers block the insecure scripts and may drop the padlock. To fix it, change every resource URL to https://.
How long SSL certificates last
The CA/Browser Forum sets the maximum lifetime of public TLS certificates. Its ballot SC-081, passed on 11 April 2025, cuts that maximum in steps. The schedule is in section 6.3.2 of the Baseline Requirements:
| Certificate issued | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| From 15 March 2026 | 200 days |
| From 15 March 2027 | 100 days |
| From 15 March 2029 | 47 days |
The 200-day limit applies today. Let's Encrypt certificates already last 90 days by default. Shorter lifetimes mean more renewals, so manual renewal stops being practical. Automate renewal with ACME, through Certbot or the built-in renewal of your host or content delivery network (CDN). Check the expiry date after each renewal.
Frequently Asked Questions
Does every website need SSL?
Yes. Browsers mark HTTP pages as "Not Secure", and Google uses HTTPS as a ranking signal. Let's Encrypt and most hosting providers issue DV certificates for free, so cost is no reason to skip HTTPS.
How do I check when an SSL certificate expires?
Enter the domain in an SSL certificate checker, which shows the expiry date and the days left. On the command line, openssl prints it as the notAfter date, as shown in Method 3.
How often should I check my SSL certificate?
Check it after every renewal and well before the expiry date. With automatic renewal, a monthly check confirms that renewal still works. Our SSL checker marks a certificate as expiring when 30 days or fewer are left.
Can an SSL certificate expire without warning?
Yes, when automatic renewal fails quietly. Common causes are DNS changes that break domain validation, a firewall that blocks the CA's validation request, or a renewal job that stopped running.
Does a padlock mean a website is safe?
No. The padlock means the connection is encrypted and the certificate matches the domain. Phishing sites can get DV certificates too, so check the domain name itself before you enter a password.
Is a free SSL certificate as secure as a paid one?
Yes, for encryption. A free DV certificate from Let's Encrypt uses the same TLS protocol and ciphers as a paid one. Paid OV and EV certificates add a check of the organization behind the domain, not stronger encryption.
Wrapping up
You can check an SSL certificate with an SSL checker, in the browser, with openssl or curl, or in Certificate Transparency logs. The first three show the certificate the server uses now, and CT logs show every certificate issued for the domain. To check a site, enter its domain into our SSL checker, or run a hosting check to see the certificate next to the DNS records and the hosting provider.
Related articles
- SSL Certificate Types Explained: DV, OV and EV
- How to find DNS records for any domain, including the CAA records that limit which CAs may issue certificates for your domain
- Where Is This Website Hosted? How to Find Out
- What Is DNS and How Does It Work?
Written by
Piotr KulpinskiFounder of HostingChecker.online and a web developer with over a decade of experience in DNS, hosting infrastructure, and domain management. Piotr builds tools that help developers and site owners understand their web stack. Other products: Highseat, OpenAlternative, EuroAlternative, Revinel and Dirstarter.