After installing or renewing a certificate, or when a visitor reports a warning, you want to know exactly which certificate the server is presenting: who issued it, which names it covers and when it expires. Here are four quick ways to check.
Before you start
- Know the exact hostnames to test, for example
example.com,www.example.comandmail.example.com. - Use a private browser window so you are not looking at cached results.
In the browser
- Open
https://example.com. - Click the icon to the left of the address (the padlock or site settings icon).
- Choose Connection is secure → Certificate is valid in Chrome or Edge, or Connection secure → More information → View Certificate in Firefox.
- Check Issued to (and the Subject Alternative Names list), Issued by and Valid from / to.
In cPanel
- cPanel → Security → SSL/TLS Status lists every domain and subdomain with its certificate status and expiry. Icons show which names are covered by AutoSSL, which have a paid certificate and which have none.
- cPanel → Security → SSL/TLS → Manage SSL sites shows installed certificates per domain, with the issuer and the expiry date.
From the command line
On any computer with OpenSSL (Linux, macOS, or Git Bash on Windows):
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -subject -dates -ext subjectAltNameThe output shows the issuer, subject, notBefore and notAfter dates and every name covered. The -servername option is important on shared IPs, where SNI selects the right certificate.
To check the mail server's certificate on port 993 (IMAP) or 465 (SMTP), change the port and use the hostname you configure in your email client.
With an online checker
Tools such as SSL Labs' SSL Server Test examine the full chain, supported TLS versions and common misconfigurations. A result of "Chain issues: Incomplete" means intermediate certificates are missing, which breaks some phones and apps even when your desktop browser looks fine.
What to look for
| Check | Good result |
|---|---|
| Names | Every hostname visitors use is listed |
| Issuer | A public CA, not your server's name (self-signed) |
| Expiry | More than a few weeks away, or renewed automatically by AutoSSL |
| Chain | Complete, ending at a trusted root |
| Protocols | TLS 1.2 and 1.3 only |
Troubleshooting
- Browser shows a different certificate than cPanel: a CDN or proxy in front of the site presents its own; or DNS points to another server.
- OpenSSL shows the server hostname certificate: you forgot
-servername, or the domain has no certificate installed. - Expiry very soon on an AutoSSL certificate: renewal may be failing; check the AutoSSL log in SSL/TLS Status.
Monitor certificates automatically
Checking by hand works for one site, but if you manage many domains, let a tool watch them. Many uptime monitoring services alert you a set number of days before a certificate expires. Resellers can also review all accounts at once in WHM → SSL/TLS → Manage SSL Hosts, which lists every installed certificate with its expiry date. Combine monitoring with AutoSSL, which renews free certificates on its own, and you will rarely be surprised by an expired certificate.