You can check a website's SSL certificate in under a minute: click the padlock or connection icon next to the address, open the certificate details, and confirm three things. The name matches the site, a trusted authority issued it, and today's date falls inside its validity window. That tells you the connection is encrypted and the site is who its certificate says it is. It does not tell you the people behind the site are honest, and that gap is where most scams live.
This guide walks through the browser check step by step, explains what a deeper technical test looks at, and shows how to read the results. It also covers the questions that usually come next: whether HTTPS means safe, what a self-signed certificate risks, and what DNSSEC is.
TL;DR
- Click the icon beside the address bar, open the certificate details, and check the issuer, the name it was issued to, and the validity dates.
- A valid certificate means the connection is encrypted. It is not a verdict on the site's honesty, because attackers can get valid certificates for phishing domains.
- A browser certificate warning is almost always a real problem. Do not click through on banking, email, or payment pages.
- DNSSEC is a separate, optional layer that protects DNS lookups. Many legitimate sites don't use it, so its absence alone is a minor finding.
- Pair the certificate check with a reputation check. Our free trust checker does that in one paste.
Table of Contents
- What an SSL certificate check actually tells you
- How to check a certificate in your browser
- What a deeper SSL test looks at
- Does HTTPS mean a site is safe?
- When your browser shows a certificate warning
- DNSSEC: the other half of the question
- Our perspective: certificates are a checkpoint, not a verdict
- Run the certificate check and the trust check together
- A practical routine for different readers
- Red flags that matter more than the padlock
- FAQ
- Sources
What an SSL certificate check actually tells you
People still say "SSL," but the protocol in use today is TLS (Transport Layer Security), its successor. The certificate is the file a site presents to your browser to prove its identity and to set up encryption. A check simply inspects that file and the way the server presents it.
Per CISA's guidance on website certificates, your browser's indicators rest on three factors: the address you typed matches the certificate, a recognized and trusted authority signed the certificate, and the current date sits within the certificate's validity period. If all three hold, the browser shows its normal secure indicator. If one fails, you get a warning.
That is a narrow claim, and it is worth being exact about what it covers:
- Encryption: what you send to the site cannot be read in transit by someone on the same Wi-Fi network.
- Identity of the domain: you are talking to the server that holds the certificate for that domain name.
- Nothing else. It says nothing about who runs the business, whether the products exist, or whether your order will ever ship.
Keep that boundary in mind and the rest of this article falls into place.
How to check a certificate in your browser
Every major desktop browser lets you inspect a certificate without installing anything. Menu names shift between versions, so treat the labels below as a guide rather than a script.
- Open the site. Load the page you want to check. Type the address yourself rather than following a link from an email or text message.
- Click the icon at the left of the address bar. It is usually a padlock or a connection-settings icon. CISA notes that you can reach certificate details by clicking the padlock.
- Open the connection or certificate details. Look for wording such as "Connection is secure," then "Certificate is valid" or "Show certificate."
- Read the issued-to field. The domain listed should match the site you intended to visit, character for character. A certificate for a near-match such as a swapped letter or an extra word is a classic red flag.
- Read the issuer. It should be a recognized certificate authority (CA), the organization browsers trust to vouch for sites. You don't need to know every CA by heart. You need to notice when the issuer is the site itself or something unrecognizable.
- Check the validity dates. The "valid from" date should be in the past and the "valid to" date in the future.
That takes about 30 seconds. If the site is a store, a login page, or a payment form, it is worth the 30 seconds before you type anything.
What the fields mean
| Field | What it tells you | What to watch for |
|---|---|---|
| Issued to (Common Name / SAN) | The domain names the certificate covers | A name that differs from the address bar, or a wildcard on a domain you don't recognize |
| Issued by | The CA that signed it | The site signing its own certificate, or an unknown issuer |
| Valid from / to | The window in which the certificate is accepted | An expired date, or one that starts only days ago on a site claiming a long history |
| Organization (if shown) | The legal entity, on higher-validation certificates | Missing is normal for basic certificates, so don't treat absence as a warning on its own |
The organization field deserves a note. Many certificates only prove control of a domain, not the identity of a company, so a blank organization line is common and not suspicious by itself.
What a deeper SSL test looks at
The browser check answers "does my device trust this?" A dedicated online certificate test answers "is this server set up correctly?" That matters most if you own the site, but it also helps if you are vetting a business partner's domain.
According to TamingDNS's SSL checker documentation, a certificate counts as healthy when four things are true:
- Trusted chain. The certificate chains up to a public CA. Servers sometimes forget to send an intermediate certificate, which makes the site work on one device and fail on another.
- Hostname coverage. The domain you are visiting appears in the certificate's Subject Alternative Name (SAN) list. SAN is simply the list of names the certificate is allowed to speak for.
- Validity period. Today falls inside the dates.
- Key strength. The key meets modern standards, which the same source gives as RSA 2048 or better, or a modern elliptic-curve key.
Good tests of this kind also report which TLS versions the server still accepts, since a server that allows very old versions is weaker than one that doesn't. Results usually come back within seconds. We deliberately describe these tools by type here: any reputable one that connects to the server and reports the chain, names, dates and protocol versions will do the job.
Why a certificate can look fine to you and broken to someone else
Browsers and operating systems each keep a "trust store," a list of CAs they accept. According to the same source, a certificate can pass on one device and fail on another if the second device lacks a needed root or intermediate certificate. Outdated software and network inspection tools are common causes.
The inspection case is worth understanding. Some workplace and school networks, and some security products, decrypt HTTPS traffic by installing their own trusted certificate on your device. CISA has warned that HTTPS interception can weaken TLS security when the inspecting product does not validate certificates correctly. It has also documented a worse case: Superfish adware on some Lenovo PCs installed a non-unique trusted root certificate that let an attacker spoof HTTPS traffic.
The practical lesson: if the issuer shown for a major site such as your bank is your employer's name or some software vendor, that is worth a question to whoever manages the network. If you are at home on a personal device, treat it as a reason to scan the machine.
Does HTTPS mean a site is safe?
No. This is the single most important thing to take from an SSL certificate check.
CISA's guidance is consistent on this point: the padlock and HTTPS indicate that traffic is encrypted, not that the website is trustworthy, and attackers exploit the assumption by hosting phishing pages on HTTPS. As TamingDNS puts it, attackers can obtain free, valid certificates for malicious domains, which earns a phishing site the same secure indicator a bank gets.
So what does the padlock mean, and what doesn't it? Here is a quick reference.
| The padlock or HTTPS means | It does not mean |
|---|---|
| Data between you and the server is encrypted | The business is real or legitimate |
| The certificate matches the domain you see | The domain is the one you meant to visit |
| A trusted CA signed the certificate | The site is free of malware or fake listings |
| The certificate is within its dates | The owner will deliver what they promise |
A green or "secure" look is therefore a floor, not a ceiling. A site without it deserves suspicion, especially if it asks for a password or card number. A site with it still has to earn trust some other way.
Those other ways are the ones we cover in our guides on phishing website warning signs and common unsafe website signs: domain age and ownership, contact details that actually work, reputation from independent sources, and pressure tactics in the page copy.
When your browser shows a certificate warning
A full-page warning about a certificate is the browser telling you one of its three checks failed. According to security practitioners cited by TamingDNS, such an error is almost always a sign of a real issue: either a server-side misconfiguration or, more dangerously, an attempt to intercept your connection (a man-in-the-middle attack).
Here is how to respond, depending on the situation.
- Banking, email, shopping, anything with a login or card number: back out. Do not use the "proceed anyway" option. Try again later, and if the warning persists, reach the company through a phone number or app you already trust.
- A small site you own or manage: the warning is yours to fix. Check the expiry date first, since an expired certificate is the most common cause, then check that the full chain is installed.
- A warning on every site, on one device: suspect the device. Check the system clock (a wrong date makes valid certificates look expired), update the browser and operating system, and look for software that intercepts traffic.
- A warning on public Wi-Fi: disconnect. A network that interferes with certificates is not one to enter passwords on.
Our explainer on how browser security warnings work goes through the common warning screens in more detail.
Self-signed certificates: what the risk is
A self-signed certificate is one the site vouches for itself, with no CA involved. Browsers have no reason to trust it, so they warn. That doesn't make every self-signed certificate malicious: they are common on home routers, internal company tools, and test servers.
On a public website that asks you for anything, though, a self-signed certificate means nothing in the connection proves who you are talking to. An attacker in the middle could present their own self-signed certificate and you would see the same warning you'd see from a careless admin. You cannot tell the two apart from your seat, which is why the safe rule is simple: on a public site, don't proceed.
Short-lived and expiring certificates
Expiry dates are a useful quiet signal. Most reputable sites automate renewal. Let's Encrypt, a large free CA, issues certificates with short lifetimes meant to be renewed automatically, and automated systems commonly renew every 60 to 90 days.
So a short validity period is normal, even a good sign. What stands out is the reverse: a certificate close to expiry, with under 30 days left and no sign of renewal. That often points to poor maintenance or an abandoned project. It's an early hint rather than proof, which is why we weigh it with other signals instead of treating it as a verdict.
DNSSEC: the other half of the question
If you searched for certificate checks, you may also have seen DNSSEC mentioned. It's easy to mix up with SSL, but they do different jobs.
DNS is the internet's address book: it turns a name like example.com into the IP address of a server. DNSSEC (Domain Name System Security Extensions) adds digital signatures to DNS records using public-key cryptography, so your device can confirm the answer it received is legitimate and wasn't tampered with. It helps prevent DNS spoofing and cache poisoning, where a forged answer sends you to the wrong server.
The division of labor, as IBM's overview describes it:
- SSL/TLS encrypts the channel between your browser and the site.
- DNSSEC protects the lookup that decides which server your browser contacts.
- Together they give defense in depth. Neither one replaces the other, and DNSSEC does not encrypt your traffic.
How important is DNSSEC for judging a site?
Less than most people expect. DNSSEC is an optional hardening measure, and as of 2026 deployment remains patchy: plenty of reputable sites run without it. So a site without DNSSEC is not suspect for that reason alone. We treat it as a low-severity finding.
Where it does matter is on high-value targets, such as financial services, government, and anyone whose domain would be worth hijacking. For them, a missing DNSSEC setup is a gap worth closing, because a forged DNS answer can send visitors to a lookalike server.
How to check DNSSEC status
Enter the domain into a DNSSEC lookup tool. These tools report whether the domain is signed and whether the chain of signatures validates from the root down. Possible results:
- Signed and valid: DNS answers can be verified.
- Not signed: the common result, and a minor point on its own.
- Signed but failing validation: the one to take seriously. A broken DNSSEC configuration can make a site unreachable for users whose resolvers validate, and it can also indicate tampering.
Our perspective: certificates are a checkpoint, not a verdict
We built Verified.fyi because the certificate question gets asked at the wrong moment. People check the padlock, see it's there, and relax. In practice, the padlock tells you almost nothing that separates a legitimate shop from a fake one, since both can have it.
That is why our checker treats the certificate as one input among more than 200 signals: security, ownership, reputation, infrastructure, transparency and compliance, drawn from sources such as Google Safe Browsing, VirusTotal, WHOIS and public reviews. Certificate validity, chain, and expiry sit in the infrastructure group. DNSSEC is a small hardening factor. Domain age, ownership transparency, blocklist status and what other people report weigh far more when the question is "will this site cheat me?"
Two more things we hold to. First, the weighting is contextual: a new personal blog and a payment page are not judged by the same yardstick. Second, our verdicts are not for sale. We refuse direct payments and pay-for-a-better-score offers, so a site cannot buy its way up from "suspicious."
My practical advice is a two-step habit. Do the 30-second certificate check when something looks off or when a page wants your card. Then, before you give an unfamiliar site money or credentials, check its reputation rather than its encryption.
— Nick
Run the certificate check and the trust check together
If you want the reputation side handled in one step, paste the address into our free website trust checker. You get a 0 to 100 trust score, a breakdown of the risks behind it, and a verdict in one of five bands: dangerous, suspicious, caution, mostly safe, or trusted. There is no registration. You can also browse recently checked websites to see how real sites score, or look at a sample report such as our review of DigiCert.com, a certificate authority, to see how infrastructure signals appear in a result.
If you run a legitimate site and want visitors to see it has been checked, we also offer a trust badge.
A practical routine for different readers
The right depth depends on what you're about to do.
- Online shoppers: check the domain spelling, then the certificate name, then the reputation. Our safe online shopping checklist and guide to verifying a payment page before you pay cover the steps at checkout.
- Freelancers and small business owners: a client's or partner's site should have a valid certificate matching its domain, a sensible renewal pattern, and a traceable owner. See business website authenticity for how to verify the company behind a domain.
- Parents: teach children that the padlock means "private," not "good." A kid-friendly rule is to stop and ask when a site wants personal details, whatever the icon shows.
- Site owners: monitor expiry, make sure the full chain is installed, and automate renewal. Most certificate trouble comes from a missed renewal rather than an attack.
For a broader routine on pages you have never seen before, our guide to staying safe on unfamiliar websites puts these checks in order, and three quick checks for spotting malicious websites is a short version you can keep in mind.
Red flags that matter more than the padlock
When the certificate is valid and you still have doubts, look for these:
- A domain registered very recently, or with hidden ownership, on a business claiming years of history.
- Prices far below every other seller, paired with countdown timers and "only 2 left" pressure.
- No working contact details, no physical address, no returns policy, or policy pages copied from another store.
- Payment requests by wire transfer, gift card, or cryptocurrency only.
- A site that reached you through an unexpected message and asks you to log in.
- Poor or reused text, broken links, and logos that are slightly off.
Any one of these on a site with a perfect certificate is a reason to slow down. Two or three together should end the visit.
FAQ
How do I check if a website has a valid SSL certificate?
Click the padlock or connection icon beside the address, open the certificate details, and confirm the name matches the site, the issuer is a recognized authority, and today's date is within the validity dates. If the browser loads the page without a warning, those three checks have already passed. For a closer look at the chain and server settings, use an online certificate test.
Does HTTPS mean a website is safe?
No. HTTPS means your connection to the site is encrypted, and CISA's guidance says it does not show the site is trustworthy. Phishing sites can and do use valid certificates. Judge a site by its identity and reputation as well.
What does the padlock icon mean?
It means the browser verified the certificate and set up an encrypted connection. It is a statement about the connection, not about the people running the site. A green or secure look carries the same limit.
Is a self-signed certificate dangerous?
On a public website, treat it as a stop sign. Nothing independent vouches for the site's identity, and you can't distinguish a careless owner from an interceptor. Internal tools and home devices use them legitimately, but you should not enter passwords or card details on a public site that presents one.
Is DNSSEC required for a site to be trustworthy?
No. DNSSEC is an optional layer that protects DNS lookups, and many reputable sites run without it. Its absence is a minor finding. A DNSSEC setup that is signed but fails validation is more concerning.
Sources
- Understanding Website Certificates, CISA
- HTTPS Interception Weakens TLS Security, CISA
- Lenovo Superfish Adware Vulnerable to HTTPS Spoofing, CISA
- SSL Checker: TLS certificate test, TamingDNS
- What Is DNSSEC (DNS Security Extensions)? IBM
- Let's Encrypt FAQ