How SSL Certificates Work and How to Check Expiry

Use this when a padlock is broken, when you rotated a cert and want a second view, or when you are counting days to notAfter. Do not point it at internal VIPs or hosts you are not allowed to probe.

What the certificate is asserting

The leaf (end-entity) certificate has:

• Subject / SAN - the hostnames it is valid for. Modern browsers use Subject Alternative Name, not the old Common Name alone. example.com does not automatically cover www.example.com unless both appear (or a matching wildcard).
• Validity window - notBefore and notAfter. Outside that window the cert is rejected. Clock skew on the client can look like an expiry bug.
• Public key and signature - the server proves it holds the private key. The checker does not need that private key; if it did, something would be very wrong.
• Issuer - which intermediate (or CA) signed the leaf.

Encryption is the other half of TLS. The certificate’s job in the handshake is authentication of the name, not “this page cannot be evil.”

The chain: leaf, intermediates, root

Browsers trust a root store. The server is supposed to send the leaf plus intermediates so the client can build a path to a root. A missing intermediate is the “works on Chrome, fails on some Java clients” classic: Chrome has the intermediate cached, the other client does not.

When you check expiry, look at the leaf first - that is what you renew. Then glance at intermediates. A nearly expired intermediate from your CA is a vendor problem; a nearly expired leaf is yours.

SSL Certificate Checker reports what the public server sent during a handshake from the checker’s network. A different IP behind the same name (geo DNS) can present a different cert. If that matters, resolve first with Domain to IP or DNS Record Lookup, then compare.

Names: SAN, wildcards, and apex versus www

A wildcard *.example.com matches www.example.com and app.example.com. It does not match example.com itself, and it does not match a.b.example.com (only one label). Staging hosts (stg.example.com) need their own name on the cert or a wider wildcard you actually intended.

After a rebrand or a “we added HTTPS to the apex,” the usual failure is a cert that only lists www. The handshake succeeds for one name and fails for the other. Type the hostname users type.

SNI (Server Name Indication) means one IP can serve many certificates. The name you send in the handshake selects the leaf. A checker that connects to the raw IP without SNI may see a default cert that humans never see in a browser. Prefer the hostname.

Expiry, automation, and what “valid” hides

Browsers treat an expired leaf as a hard error. There is no polite banner you can dismiss on behalf of customers.

Short-lived certificates (Let’s Encrypt and similar) assume automation. If a cron job died, you will discover it on notAfter, not in a quarterly review. Longer-lived commercial certs fail the opposite way: someone bought 13 months, nobody calendar’d the date, and a holiday weekend became an incident.

A checker showing 40 days left is a planning input, not a performance score. Pair it with whatever actually renews the cert (Certbot, ACME in the load balancer, the CDN’s managed cert).

Also confirm you are looking at the edge users hit. An origin cert can be valid while the CDN’s customer-facing cert is the one that expires - or the reverse.

How to check a public hostname

1. Use a name you are allowed to connect to. Production sites you operate, or public sites in a genuine debug: yes. A random internal hostname: no.
2. Open SSL Certificate Checker and enter the hostname (not a file path, not a private IP).
3. Read notAfter, SAN, and issuer. Confirm the name you care about is on the SAN list.
4. If the connect fails entirely, check DNS first - DNS Record Lookup - so you know you are not handshaking with last week’s IP.
5. If the handshake works but HTTP looks wrong, continue with HTTP Header Viewer (HSTS, redirects).

OpenSSL’s s_client is the command-line version of the same idea: it also opens a network connection.

What a green padlock never promised

It never promised the company is legitimate beyond “someone who could follow the CA’s validation process for this name.” It never promised the HTML is free of XSS. It never promised the IP is the one you allow-listed last year.

It also does not replace header inspection. HSTS is a header, not a field inside the X.509 file. See How to Read HTTP Headers.

Check the live certificate on purpose

When you need the live public certificate, open SSL Certificate Checker and send the hostname on purpose. If the name does not resolve, fix DNS first with DNS Record Lookup. For the rest of the diagnostic set, use Best Free Networking Diagnostic Tools.