To check whether a website certificate has expired, inspect its Valid to or Not After date and compare it with the current date and time. Then confirm that the certificate covers the exact hostname in the address bar and that the server presents a trusted certificate chain. A future expiry date alone does not rule out a hostname mismatch, a missing intermediate certificate, or a trust-store problem.
Check the certificate in your browser
A browser viewer shows the certificate presented to that browser for its connection. In Firefox, open the site information panel from the address bar, open the connection details and more site information, then select View Certificate. Labels may differ between Firefox releases; when a warning appears, certificate details can also be opened from the warning page.
As an Amazon Associate I earn from qualifying purchases.
- Read the certificate’s validity period. If its Valid to or Not After time is in the past, the certificate has expired. A future date only confirms that it is within its stated validity period.
- Compare the requested address with the certificate’s listed names, including the Subject Alternative Name entries. Check the hostname actually in the address bar, such as
www.example.comversusexample.com. - Look at the issuer and the certificate chain. Firefox’s viewer separates the TLS server certificate, intermediate certificate, and root certificate; an acceptable-looking server certificate can still fail if the chain cannot be trusted.
Mozilla’s certificate guide describes the viewer and the certificate details it exposes.
Check a public HTTPS endpoint with OpenSSL
OpenSSL’s s_client can show the certificates sent by a server and report verification results. Run this in a terminal, replacing the example with the exact hostname you want to test:
#1 Best Overall
openssl s_client -connect example.com:443 -servername example.com -showcerts -verify_return_error
-connectspecifies the server and port. This example tests HTTPS on port 443.-servernamesends the hostname using SNI, which helps a server hosting multiple HTTPS sites choose the certificate for the requested name.-showcertsdisplays certificates sent by the server.-verify_return_errormakes verification errors abort the handshake. Without it,s_clientis designed to continue after certificate verification errors.
OpenSSL’s s_client documentation notes that options can vary; check the local openssl s_client -help output for your installed version. OpenSSL’s TLS guide uses Verification: OK to indicate a successful trust check. An error such as unable to get local issuer certificate means the client could not find an issuer in its trust store. That can indicate a missing intermediate from the server, a local trust-store problem, or an issuer that store does not recognize—not necessarily an expired certificate. See the OpenSSL TLS client guide for verification failure examples.
Rank #2
Output depends on the OpenSSL version, its trust store, and the server’s response. Treat the command as a diagnostic check, not as a reason to disable certificate verification in applications.
Run a remote test with SSL Labs
Qualys SSL Labs’ SSL Server Test performs a deeper analysis of a publicly reachable SSL/TLS web server. Enter the public hostname and review the certificate and configuration findings. It does not necessarily reproduce a private service, a different port, or the trust environment of the particular device where a warning appeared.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
What common results mean
- Expired: The server certificate’s validity end time has passed. A site owner should renew or replace it and ensure the intended certificate is deployed on every relevant serving endpoint.
- Hostname mismatch: The certificate’s names do not cover the hostname requested. Check the address, certificate names, and which certificate the server selects for that hostname.
- Missing intermediate: The server may not be sending an intermediate certificate needed to link the server certificate to a trusted root. The site owner should install and serve the intended complete chain, then retest.
- Untrusted issuer or trust-store error: The client cannot build a trusted path using its trust store. Establish whether the server’s chain is incomplete or the affected client has a trust-store issue before changing server settings.
- Different findings across devices or tests: Match the hostname, port, and endpoint first. Browser inspection, OpenSSL, and a remote scanner may reach different server instances or use different trust contexts.
A browser message can help narrow the possibilities but does not prove the cause. Cloudflare’s SSL error guide, last updated April 16, 2026, maps common error strings to possible SSL/TLS issues and notes that SNI compatibility can affect some older clients. Verify the presented certificate and chain rather than diagnosing from the message alone.
Choose the right checking method
| Method | Best for | Main limitation |
|---|---|---|
| Browser certificate viewer | Quickly viewing certificate details received by a specific browser | Browser-specific navigation and connection context. Mozilla |
OpenSSL s_client |
Inspecting certificates sent by an endpoint and viewing verification output | Output and options depend on version and trust store; by default the test utility can continue after verification errors. OpenSSL TLS guide |
| Qualys SSL Labs SSL Server Test | Remote, deeper analysis of a public web server’s configuration | May not reproduce a private endpoint or an individual client’s environment. Qualys |
What to do if you see a certificate warning
For a website owner, use the result to identify whether the needed fix is renewal, certificate-name coverage, server certificate selection, or the complete chain. Retest the same hostname, port, and endpoint after making a change. For an ordinary visitor, treat the warning as a security signal and do not bypass it for logins, payments, or other sensitive activity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
