⚠️ IMPORTANT DISCLAIMER: The tools and scripts on this site are provided "AS IS" for educational purposes.
Review destructive commands before executing. By using this site, you assume all risk and agree to our Full Terms of Service.
Check a site’s certificate from the command line
Enter a domain and port. The page tests whether your browser can make a trusted HTTPS connection, which fails fast for expired or untrusted certificates, and builds the OpenSSL commands that show the details: expiry dates, the full chain, the names covered and the TLS versions the server accepts.
Common questions
How do I check an SSL certificate’s expiry date from the command line?
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates prints notBefore and notAfter. Add -checkend 2592000 to the last command to fail if it expires within 30 days, handy in a cron job.
What does “unable to get local issuer certificate” mean?
The server isn’t sending its intermediate certificate, so the client can’t link your certificate to a trusted root. Browsers sometimes cope, but curl, Java and many APIs fail. Configure the full chain (in nginx, ssl_certificate should point to the certificate followed by the intermediates).
How do I see the whole certificate chain a server sends?
openssl s_client -connect example.com:443 -servername example.com -showcerts prints every certificate the server sends, in order. The leaf comes first, followed by the intermediates.
How do I check which TLS versions a server supports?
Try each one: openssl s_client -connect example.com:443 -tls1_2 and -tls1_3. A handshake that fails means the version is disabled. TLS 1.0 and 1.1 should be off on any modern server.
Why does -servername matter?
Servers hosting several sites use SNI to pick the certificate. Without -servername, openssl may get a default certificate for a different site and report a name mismatch that browsers never see.