How do I check when an SSL certificate expires from the command line?

Run: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate. This outputs the expiration date in GMT. For a more readable output with days remaining, parse the date and compare with the current timestamp. Set up a cron job or monitoring tool to alert when certificates are within 14 days of expiration.

Why does my site work in Chrome but fail in curl or Node.js with a certificate error?

This almost always means an incomplete certificate chain. Your server is sending the leaf certificate but not the intermediate certificate(s). Chrome can fetch missing intermediates automatically via the Authority Information Access (AIA) extension, but curl, Node.js, Python, and most API clients cannot. Fix this by configuring your server to send the full chain: concatenate your leaf cert and intermediate cert into one file (fullchain.pem).

What is the difference between a wildcard certificate and a SAN certificate?

A wildcard certificate (*.example.com) covers all single-level subdomains (www.example.com, api.example.com) but NOT the apex domain (example.com) or multi-level subdomains (a.b.example.com). A SAN (Subject Alternative Name) certificate lists specific domains explicitly. In practice, you often combine both: issue a certificate with SANs for example.com and *.example.com to cover all cases.

How does HSTS affect SSL certificate issues?

When HSTS is enabled, browsers refuse to connect if there's any certificate error — there's no 'Proceed anyway' bypass option. This means an expired certificate on an HSTS-enabled site completely blocks all visitors until the certificate is renewed. Before enabling HSTS, ensure auto-renewal is reliable and monitored. Start with a short max-age (300 seconds) and increase gradually. HSTS preload list removal takes months if you need to roll back.

How do I set up automatic SSL certificate renewal with Let's Encrypt?

Install Certbot and run 'certbot certonly --nginx -d example.com' to obtain the initial certificate. Certbot installs a systemd timer (or cron job) that runs 'certbot renew' twice daily. Verify with 'certbot renew --dry-run'. Add a post-hook to reload your web server: --post-hook 'systemctl reload nginx'. Common renewal failures: port 80 blocked (HTTP-01 challenge), DNS API credentials expired (DNS-01 challenge), or web server config changed. Monitor expiration dates independently as a safety net.

Validating SSL Certificates and Common Issues