How to Check SSL Certificate Expiry, Trust Chains & TLS Versions

1. What Is an SSL/TLS Certificate and How Does It Secure Websites?

When users connect to your website over HTTPS, their web browser and your server execute a cryptographic negotiation known as the Transport Layer Security (TLS) handshake. The cornerstone of this handshake is the SSL/TLS Certificate.

An SSL certificate serves two fundamental purposes: authentication (proving that your website is legitimately owned by you and not an impostor) and encryption (scrambling data in transit so that internet service providers, hackers on public Wi-Fi, and eavesdroppers cannot intercept sensitive passwords, cookies, or credit cards).

Without an SSL certificate, modern web browsers like Google Chrome, Safari, and Firefox immediately display prominent red security alerts declaring 'Your connection is not private', causing over 85% of visitors to abandon the site immediately.

2. The Anatomy of a Certificate Trust Chain

How does a web browser in Tokyo or New York know whether a certificate presented by your website is legitimate? The answer lies in the Public Key Infrastructure (PKI) Trust Chain.

1. The Root Certificate Authority (Root CA): Operating systems (Windows, macOS, Linux, iOS, Android) and web browsers come pre-installed with a highly protected store of Root Certificates from audited organizations like Let's Encrypt (ISRG), DigiCert, Sectigo, or GlobalSign.

2. The Intermediate CA: Root CAs are kept in offline hardware security modules (HSMs) to prevent compromise. To issue everyday certificates, the Root CA delegates authority to Intermediate CAs.

3. The Leaf (End-Entity) Certificate: This is the certificate installed on your web server for your specific domain name (e.g. yourdomain.com). The browser traces the cryptographic signature from your leaf certificate up through the intermediate certificate to the trusted root CA in its local store.

[Trusted Root CA: ISRG Root X1] (Stored in operating system)
          │
          ▼
[Intermediate CA: Let's Encrypt E6] (Signed by Root)
          │
          ▼
[Leaf Certificate: yourdomain.com] (Installed on your web server)

3. Understanding Subject Alternative Names (SANs)

In older versions of SSL certificates, only a single domain could be secured via the Common Name (CN) field. Today, modern certificates rely on the Subject Alternative Name (SAN) extension.

The SAN field allows a single certificate to secure multiple distinct hostnames under one unified cryptographic umbrella. For example, a single certificate might list:

- example.com

- www.example.com

- api.example.com

- *.example.com (Wildcard covering all first-level subdomains)

Checking the SAN extension is vital when diagnosing certificate mismatch errors (e.g., SSL_ERROR_BAD_CERT_DOMAIN), which occur when a visitor navigates to a subdomain that was omitted from the certificate's SAN list during issuance.

4. How to Check SSL Expiration via Command Line

Network administrators and DevOps engineers frequently audit certificate expiration dates using built-in terminal tools like OpenSSL and cURL before automated renewals fail.

# Inspect expiration date and issuer using OpenSSL:
openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -issuer

# Output:
# notBefore=Aug 15 00:00:00 2026 GMT
# notAfter=Nov 13 23:59:59 2026 GMT
# issuer=C=US, O=Let's Encrypt, CN=E6

# Quick expiry check via cURL:
curl -Iv https://example.com 2>&1 | grep -i "expire"

5. Best Practices for Zero-Downtime Certificate Maintenance

To prevent catastrophic certificate expirations from breaking customer transactions, adhere to these operational principles:

- Automate Renewals via ACME: Use automated clients like Certbot, Caddy, or Cloudflare Universal SSL to automatically renew certificates 30 days before expiration.

- Monitor Expiration Telemetry: Set up alerts at 30 days, 14 days, and 7 days prior to expiry.

- Enforce TLS 1.3: Deprecate legacy TLS 1.0 and 1.1 protocols in your Nginx or Apache server configurations to prevent cryptographic downgrade attacks.