SSL Certificate for Mac

$ openssl s_client -connect example.com:443 -showcerts

What it’s for

A website proves who it is with a certificate, signed by an authority your Mac trusts. SSL Certificate connects to a server, shows the chain of certificates the server sent and, when the connection isn’t trusted, explains why in plain words.

Use it when

• A browser or an app warns that a connection isn’t private.
• You want to know when your site’s certificate expires.
• An app fails to connect to a server that works in Safari.

Reading the result

Details shows the serial number, fingerprint and key. Show Certificate… opens a certificate in the system’s viewer, and Save Certificate (PEM)… saves it as a file.

What you might see

• Incomplete chain. The server didn’t send its intermediate certificate. Browsers fetch it themselves, so the site works in Safari and fails in other apps. The server’s setup needs fixing.
• Name mismatch. The certificate doesn’t cover the name you typed. Only the names under Subject Alt Names count.
• Expired or Not valid yet, anywhere in the chain. An expired intermediate breaks a valid site certificate too.
• Self-signed or Root not trusted. Common on routers and NAS boxes. Trust one only if you know where it came from.
• Not sent by the server, on a certificate: macOS supplied it while checking the chain. Normal for a root.

Options worth knowing

• Port checks services other than websites, for example 993 for email.
• Uptime Monitor can watch a certificate and warn you before it expires.

Related

• Certificates, how the chain of trust works.
• A website won’t open.