How to Check Which Certificate a Server Is Actually Serving

Configuration files describe intent — what a server is actually presenting to a real connection can differ, especially after a change that wasn't fully applied (a missed reload, a caching layer, or multiple server blocks with unexpected priority).

echo | openssl s_client -servername yourdomain.com \
  -connect yourdomain.com:443 2>/dev/null | \
  openssl x509 -noout -subject -dates -issuer

This connects directly and prints exactly what certificate the server returned — subject, validity dates, and issuer — bypassing any browser cache or assumption based on your configuration file. If this doesn't match what you expect, the problem is in how the server is actually serving traffic, not in your configuration file's intent.

What to do if the certificate shown doesn't match what you expect to be installed

A mismatch between the expected and actually served certificate often points to a caching layer, a CDN, or a different server entirely (due to DNS or load balancing) actually handling the connection — confirming you're connecting directly to the server you intend, bypassing any CDN, isolates whether the discrepancy is server-side or elsewhere in the request path.

How to check the certificate being served on a specific port other than 443

Specifying the exact port in your OpenSSL connection command (`openssl s_client -connect yourdomain.com:8443`) checks whatever certificate is being served on that specific port, since a server can potentially serve different certificates on different ports depending on its configuration.

What a difference between the certificate shown via browser versus command line usually indicates

A discrepancy between what a browser displays and what a direct OpenSSL check shows often points to browser caching of a previous connection — clearing browser cache or testing in a private window resolves most cases where these two checks appear to disagree.

How to check certificates for multiple hostnames on the same server efficiently

Looping the OpenSSL connection command with the -servername flag set to each hostname in turn, against the same server IP, checks which certificate is served for each specific hostname efficiently, confirming SNI-based certificate selection is working correctly across every hosted domain.

Why this check is often the fastest first step when troubleshooting an unexpected certificate warning

Directly confirming exactly which certificate a server is actually serving, before investigating any more complex potential cause, quickly rules out or confirms the most basic possible explanation — that a completely different, unexpected certificate is being served rather than the one you believe should be active.

What to do if different requests to the same domain return different certificates unexpectedly

Different certificates returned for the same domain on different requests can indicate multiple servers behind a load balancer with inconsistent certificate installation, or a CDN edge location serving a different, possibly stale certificate — checking whether this varies by request or is consistently one specific certificate helps narrow down the cause.

How to check a certificate without any command-line tools using only a web browser

Clicking the padlock icon in any browser's address bar and viewing certificate details shows the issuer, validity dates, and covered hostnames directly, a fully browser-based alternative for anyone who prefers not to use command-line tools for a quick, casual check.

A closing note on this simple check's outsized diagnostic value

This straightforward check, confirming exactly which certificate a server actually presents, resolves a surprising share of confusing-seeming certificate issues by simply confirming or ruling out the most basic possible explanation before investigating anything more complex.

A final thought on this check's place in your troubleshooting habits

Keeping this specific check as a standard first step in your personal or team troubleshooting checklist for any certificate-related report ensures you always start from a confirmed, accurate picture of what's actually being served before investigating further.