An expired SSL certificate is one of those problems that announces itself loudly and at the worst possible time — usually when a client or user calls to say your site is showing a security warning. A broken certificate chain is subtler but equally damaging. Knowing how to quickly inspect any site's SSL setup saves you from being caught off-guard.
The DevToolShack SSL Checker inspects any domain's certificate in seconds — no command line needed. Enter a domain, see the full certificate details immediately.
What Is an SSL Certificate?
An SSL/TLS certificate is a digital document that does two things: it proves the identity of a website (this server really is example.com), and it enables encrypted communication between the browser and server. Without a valid certificate, browsers show security warnings that most users won't click through.
Certificates are issued by Certificate Authorities (CAs) — trusted organisations like Let's Encrypt, DigiCert, and Sectigo. When a browser connects to a site, it checks that the certificate is valid, unexpired, issued by a trusted CA, and matches the domain being visited.
What to Check in an SSL Certificate
Expiry Date
The most common SSL failure. Certificates have a maximum validity period of 398 days (about 13 months) — and Let's Encrypt certificates expire every 90 days. When a certificate expires, browsers immediately block access with a hard error.
Domain Coverage
The certificate must cover the exact domain (or domains) you're serving. Check that:
- Both
example.comandwww.example.comare covered — they're treated as different domains - Any subdomains you use are covered — either explicitly or via a wildcard (
*.example.com) - The Subject Alternative Names (SANs) include all domains you need
Certificate Chain
Your certificate doesn't stand alone — it's part of a chain of trust from your certificate up to a root CA that browsers inherently trust. If any intermediate certificate in the chain is missing or misconfigured, some browsers will reject the connection even though the certificate itself is valid.
This is one of the trickiest SSL issues to diagnose because it often works fine in Chrome (which is more lenient about fetching missing intermediates) but fails in curl, API clients, or older browsers.
Protocol and Cipher Support
Older TLS versions (TLS 1.0, TLS 1.1) are deprecated and disabled in modern browsers. Your server should be configured to use TLS 1.2 at minimum, with TLS 1.3 preferred. Weak cipher suites (RC4, DES, MD5-based) are also security red flags.
Common SSL Error Messages Decoded
| Error | Cause | Fix |
|---|---|---|
| Certificate expired | Past the notAfter date | Renew the certificate immediately |
| Certificate not yet valid | Before the notBefore date | Wait, or check server clock sync |
| Hostname mismatch | Certificate doesn't cover this domain | Get a certificate that includes the domain |
| Self-signed certificate | Not issued by a trusted CA | Replace with a CA-issued certificate |
| Incomplete chain | Missing intermediate certificate | Install the full chain on the server |
| Mixed content | HTTPS page loads HTTP resources | Update all resource URLs to HTTPS |
Checking SSL From the Command Line
If you prefer the terminal, openssl gives you full certificate details:
# View certificate details for a domain
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -text -noout
# Quick expiry check
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
# Check the full chain
openssl s_client -connect example.com:443 -showcerts < /dev/null 2>/dev/nullThe browser-based SSL Checker pulls the same information without needing openssl installed — useful when you're on a machine without shell access or need to quickly check a client's site.
Checking SSL in API and curl Calls
When your application makes HTTPS requests and gets SSL errors, the error messages are often cryptic. Common ones:
# curl SSL error examples
curl: (60) SSL certificate problem: certificate has expired
curl: (60) SSL certificate problem: unable to get local issuer certificate
curl: (51) SSL: no alternative certificate subject name matches target host nameThe second error — "unable to get local issuer certificate" — almost always means a missing intermediate certificate on the server. The SSL Checker will show you the chain and flag any gaps.
Free Certificates with Let's Encrypt
If you're still paying for SSL certificates for standard websites, you don't need to. Let's Encrypt provides free, automated, 90-day certificates that are trusted by all major browsers. Most hosting providers and web servers (Nginx, Apache, Caddy) have built-in Let's Encrypt support. Caddy in particular handles certificate issuance and renewal completely automatically with zero configuration.
The short 90-day lifetime is intentional — it forces automation and limits the damage window if a certificate is compromised. Auto-renewal should be set up from day one.