SSLWatchHow to check an SSL certificate with OpenSSL (command line)
OpenSSL commands to check SSL certificate expiry, issuer, chain and TLS version from Linux, macOS or Windows.
Expiry date
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates
Issuer and subject
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -subject
Full certificate chain
openssl s_client -connect example.com:443 -servername example.com -showcerts
Each -----BEGIN CERTIFICATE----- block is one certificate in the chain. Look for Verify return code: 0 (ok).
Test a TLS version
openssl s_client -connect example.com:443 -tls1_3 openssl s_client -connect example.com:443 -tls1_2
Check a local certificate file
openssl x509 -in cert.pem -noout -enddate
Prefer one click? Our SSL checker shows all of this instantly.