How to check SSL certificate in chrome

Click the icon left of the address, open Connection is secure, then Certificate is valid to read issuer, validity dates and SANs in the certificate viewer. When the page refuses to load, the value a bug report needs is the net::ERR_CERT_* code, not the warning screen.

Why check this

The browser is where a certificate problem is reported to you, so the browser is where the report has to be reproduced. Run this when a tester says a page is blocked, during release sign-off on a new host name, and after a certificate rotation. The failure it catches: a rotation that covered example.com and left www.example.com outside the SAN list, which the command line will not show unless you already suspect it.

Prerequisites

• Chrome on desktop. Read your own build at chrome://version and name it when you file the result.
• openssl for the cross-check in steps 4 and 5. See the s_client manual.
• The error codes Chrome can raise are listed in the Chromium net error reference.

Steps

1. 1

   Step 1.

   Open the page, then click the icon immediately left of the address bar, choose Connection is secure, then Certificate is valid.

   The certificate viewer opens on the Details tab. Issued To and Issued By are the subject and the issuer. Validity Period holds the two dates. Subject Alternative Name under Extensions lists every host name the certificate covers, which is the field a rotation most often gets wrong.

2. 2

   Step 2.

   Read the same certificate from DevTools, which also shows the connection it belongs to.

   Press F12, open the Security tab, reload the page, select the main origin in the left list, then click View certificate. The panel above the button states the protocol and the cipher for this connection. Use this path rather than the padlock when the question is which origin on the page is failing.

3. 3

   Step 3.

   Reproduce a failing certificate and record the code Chrome raises.

   $ open https://expired.badssl.com/ in Chrome
   net::ERR_CERT_DATE_INVALID at https://expired.badssl.com/

   Chrome refuses the navigation outright and raises net::ERR_CERT_DATE_INVALID before any page loads. No screenshot of the interstitial exists on this page, because automation cannot capture a screen for a navigation that never completes. The code is the thing to quote: it names the exact failure, while the screen says only that the connection is not private.

4. 4

   Step 4.

   Cross-check that code on the command line, where the dates are readable.

   openssl s_client -connect expired.badssl.com:443 -servername expired.badssl.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates
   

   subject=OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.badssl.com
   notBefore=Apr  9 00:00:00 2015 GMT
   notAfter=Apr 12 23:59:59 2015 GMT

   notAfter in 2015 is what ERR_CERT_DATE_INVALID was pointing at.

5. 5

   Step 5.

   Print the same three fields the certificate viewer shows, for a host that passes.

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
   

   subject=CN = example.com
   issuer=C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing ECC CA 3
   notBefore=Jul 29 22:10:08 2026 GMT
   notAfter=Oct 27 22:17:21 2026 GMT

   Those four lines are Issued To, Issued By and Validity Period from step 1, in a form you can paste into a ticket. A certificate viewer cannot be pasted.

How to read the result

| What you see | What it means | What to do | | --- | --- | --- | | Padlock, Connection is secure, Certificate is valid | The chain resolved and the dates are current for this client | Read the SAN list before signing off, since the padlock does not show it | | net::ERR_CERT_DATE_INVALID | The certificate is outside its validity window | Confirm with notAfter in step 4, then rotate | | Another net::ERR_CERT_* code | A different certificate failure | Look the code up in the Chromium net error reference and quote it verbatim | | The padlock is fine on one machine and the code appears on another | The trust stores differ, or a proxy is intercepting TLS | Compare the issuer between the two machines, not the warning text | | Not secure with no certificate error | The page is HTTP, or it loaded insecure subresources | This is a mixed content or redirect problem, not a certificate problem |

Common mistakes

What to check next

• How to check SSL certificate expiry: turns step 4 into a number of days that a pipeline can assert on.
• How to check SSL certificate from command line: the full command line read, including the chain the viewer collapses.
• How to check if a certificate is self-signed: the failure behind a warning on an internal host.
• How to check if mixed content exists on a page: the other reason the padlock changes without a certificate error.
• SSL certificate checker: reads issuer, dates and SANs for a host you type, with no browser involved.

FAQ

How to check certificate expiration date in chrome?

Open the certificate viewer through the padlock, then read Validity Period on the Details tab. The second date is the expiry. For a value you can paste or assert on, run the openssl command in step 4 and read notAfter.

Why can I not open the certificate on a page Chrome blocked?

The navigation never completes, so there is no connection to inspect. Read the error code instead, then run the openssl command against the same host name to see the certificate the browser refused.

Does the padlock mean the certificate is trusted by everyone?

No. It means this Chrome, on this machine, accepted the chain. A root installed by device policy is invisible in that verdict, which is why a second machine or a command line check belongs in the sign-off.

Where does Chrome show the negotiated TLS version?

In the Security panel, on the origin selected in the left list, alongside the cipher. The padlock flyout does not show it.

Verified