$ openssl s_client
Inspect the TLS certificate chain of a host: validity, SANs, issuer, trust and hostname match.
About the ssl tool
The SSL/TLS certificate checker connects to a host and port, downloads the certificate chain it presents and checks it: validity dates, issuer, subject alternative names (SANs), whether the name matches and whether the chain is trusted. Use it to catch expiring or misconfigured certificates before visitors do.
How to read the results
Not after is the expiry date; renew before it. The SANs list every hostname the certificate covers, and the host you test must appear there. A trusted chain ends at a public root; a missing intermediate certificate is the most common cause of errors on some devices but not others. Port 443 is HTTPS; 465, 993, 995 are mail over TLS and 636 is LDAPS.
FAQ
- How do I check when my SSL certificate expires?
- Enter the hostname and port 443. The result shows the validity dates and days remaining.
- Why does my site work in a browser but fail here or in apps?
- Often the server does not send the intermediate certificate. Browsers may fetch it themselves; other clients cannot.
- What does hostname mismatch mean?
- The name you connected to is not listed in the certificate's SANs. Issue a certificate that includes it.
- Can I check mail server certificates?
- Yes, pick a mail TLS port such as 465 or 993.