In the efforts to secure communications over TCP/IP, we often have to deal with the certificates that are the keys to the process. Checking that the correct and correctly configured certificate (or cert for short) is the one running, is an essential troubleshooting/validation step.
The best way where possible is to check the running cert on the running service. Especially that the correct cert that is being used. Typically, we'd be looking at the dates that it is valid, the name (subject or common name), and the Subject Alternative Name (SAN)
For Web interfaces, a browser is the ultimate testing tool, with Firefox being the (currently in 2026) most consistent to work with, but the general concepts are the same with the others even if done differently. If there is a problem stopping you from getting to the page, you just have to pause there, because the details are already available.
Firefox:
For some issues, it will offer you to look at the cert below the scary sounding warning, if so, that is the easy option. Otherwise, if you've accepted the risk already or it is a good cert, you should see a little shield in front of the URL. The shield shows with a checkmark in it for good, or an Exclamation mark (Not Secure) if not.
Click on that shield, and in top right of that sub-window click on "Connection {not} secure" as the case may be. Select "More site Information" at the bottom, and then View Certificate to see a page with all the details that you can 'print' for your records (usually to pdf or such)
Chrome (and related):
If there is a cert issue stopping you with the dreaded "Your connection is not private", click on the red "Not secure" in front of the URL, where you will see the option for Certificate details to click on, and then look at. The first tab has some useful basics, but often we need to look at the details tab to expand the fields you want to look at, such as to find the Extension of 'Certificate Subject Alternative Name'. The Export option saves an actual public key that can be looked at with tools such as openssl or KeyStore Explorer that we'll discuss further down.
If the cert is accepted as a secure one, click on the slider 'tune' button in front of the URL, click on "Connection is secure", click on the "Certificate is Valid" to see the Certificate details described above.
Other options:
If you have to do this regularly, there is a GUI tool called https://keystore-explorer.org/ KeyStore Explorer that works with most GUI.
For our purposes, select 'Examine', 'Examine TSL/SSL', enter the target host and port,
With the next page not directly showing the SAN, that is one of the Extensions, where if the cert has a SAN, you see the Extension, and clicking on it shows the value(s)
Linux Systems:
If you are on a Linux system (or can shell into), we can use https://en.wikipedia.org/wiki/OpenSSL openssl from the command line without an install. Other operating systems typically need an install.
# openssl s_client -showcerts -connect {serverIP|FQDN}:443 |openssl x509 -noout -text |less
# openssl s_client -showcerts -connect google.com:443 |openssl x509 -noout -text |less
While the default secured web traffic set to port 443, others can readily be used and often are used for administrative interfaces. Also, there are many other services that use TLS to secure them, and this is where the openssl command and KeyStore Explorer are our most available options to look at them.
Direct file examination:
# openssl x509 -in server.crt -text -noout
or with KeyStore Explorer, 'Examine' from the menu, 'Examine File', browse to the file to be examined.
There are other options and ways, this is just the primer as I found many who need these steps don't know them off of hand, so this is an effort to make it easy.
