View certificate in Firefox

View ssl certificate firefox via Page Info → Security → View Certificate and read the Validity fields—the browser’s view of live notAfter on that hostname.

Firefox remains the default for privacy-conscious users and many developer workflows. When SEC_ERROR_EXPIRED_CERTIFICATE appears, support needs padlock-level detail without waiting for infra SSH.

The mistake is dismissing Firefox-specific wording while the same notAfter would break Chrome and curl. Another is inspecting a bookmarked HTTP URL that upgrades to a different host than the one marketing advertised.

You will open Firefox’s certificate viewer on current releases, interpret validity and trust fields, and pair the UI with command-line confirmation when renewals land.

What to check

Firefox shows the end-entity certificate for the secure connection behind the active tab. Capture:

• Common Name and Subject Alternative Names
• Issued By (issuer organization)
• Valid from / Valid until (or Not After in Details)
• Trust status (built-in roots vs manual exceptions)

Firefox distinguishes Technical Details versus human-readable summaries; engineers should read both during incidents.

Warnings such as The certificate has expired map directly to past notAfter. Cross-reference Secure connection failed in Firefox (date invalid) when error pages mention invalid dates.

about:config enterprise policies and corporate roots can alter trust without changing server dates—note managed browsers in tickets.

Firefox Containers isolate cookies but not DNS; still verify the hostname in the address bar before opening Page Info. Container tabs can confuse testers who forget which profile resolved staging versus production.

Linux distributions ship different Firefox builds; menu labels stay close but keyboard shortcuts differ on Wayland versus X11—confirm Ctrl+I/Cmd+I on your platform.

Step-by-step

Method A: padlock (page loaded or interstitial with cert info)

1. Go to https://HOSTNAME/.
2. Click the padlock (or Not Secure) icon in the address bar.
3. Click the connection secure row or More information.
4. Open View Certificate (opens Mozilla’s Certificate Viewer window).

Method B: Page Info dialog

1. With the tab focused, press Ctrl+I (Windows/Linux) or Cmd+I (macOS), or right-click → View Page Info.
2. Select the Security tab.
3. Click View Certificate.

Read fields

1. On the General tab, note Issued To, Issued By, and the validity period.
2. Switch to Details → expand Certificate Fields → Validity for precise timestamps.
3. Expand Certificate Subject Alternative Name when present.

Optional PEM export

• In Certificate Viewer, Miscellaneous → PEM (cert) to save the leaf for diffing serial numbers after renewal.

Command-line confirmation

HOSTNAME=example.com
echo | openssl s_client -connect "${HOSTNAME}:443" -servername "${HOSTNAME}" 2>/dev/null \
  | openssl x509 -noout -dates -serial -subject -issuer

SNI must match the hostname in the address bar.

Windows operators can run the same in Git Bash or WSL. Compare with view SSL certificate in Chrome so triage matches across browsers.

If View Certificate is greyed out, the page may be plain HTTP or blocked before TLS completes. Confirm the scheme is HTTPS and retry after fixing network paths.

For PDF.js inline viewers, certificate details still describe the parent document connection—do not assume embedded frames use the same cert without opening them in their own tab.

How to read the output

Valid until is the operational expiry seen by Firefox users. After that instant, verification fails unless users added dangerous exceptions (discourage in production).

Subject Alternative Name lists DNS names the cert covers. Wildcards appear as *.example.com; they do not cover nested names like a.b.example.com unless listed explicitly.

Fingerprints (SHA-256) help prove renewal changed material even when subject strings look identical. Record fingerprints in change tickets.

The Certificate Hierarchy panel shows intermediates Firefox sent or built. Missing or expired intermediates cause trust errors separate from leaf expiry—inspect each level’s validity in Details if users report “untrusted issuer.”

If Firefox shows Verified by: Organization X via an enterprise root, customers on the public internet may still fail—that is a split-trust scenario, not public expiry.

Certificate Pinning extensions and HTTPS Everywhere rules can block access before you open details—disable only on known-safe debugging profiles.

Mixed content upgrades may change which host appears in the URL bar mid-session; reopen Page Info after redirects settle.

Common mistakes

Adding a permanent Exception for an expired staging cert, then forgetting to remove it before copying steps to production runbooks.

Viewing certificates on about:preferences#privacy instead of the target site’s connection—always anchor to the affected tab’s hostname.

Testing only in Firefox Containers or VPN profiles that resolve different DNS than production.

Assuming Firefox’s HTTPS-Only Mode upgrades HTTP links to a hostname covered by a different certificate than marketing expects.

Firefox Enterprise Roots policy can mask expired public certs by trusting a re-signed corporate copy—validate what the general internet sees via external openssl, not only managed Firefox.

When to use automation

Padlock inspection helps support calls and ad-hoc validation; fleets need automated external TLS checks reading notAfter for every public name. Schedule alerts and keep Firefox steps in L1 playbooks.

After renewals, require dual proof: Firefox certificate viewer screenshot plus openssl output in the change record. ssldays-style monitoring catches drift between regions faster than one engineer’s laptop.

For large inventories, pair browser training with test an SSL certificate online commands so teams without Firefox still verify dates.

Mozilla publishes release notes when certificate dialogs move—subscribe if Firefox is your canonical support browser.

Capture SEC_ERROR full code strings alongside certificate screenshots; they speed mapping to err-cert-date-invalid-firefox playbooks.

When users refuse command-line tools, remote-screen Page Info walks still beat guessing renewal dates from hosting invoices.

Tor Browser builds on Firefox hardening may delay certificate dialog timing—retest on clearnet Firefox when onion services confuse investigators.

Localization changes button text; support articles should show icon positions, not only English strings like View Certificate.

Firefox Focus on mobile intentionally omits deep certificate inspection—escalate mobile incidents to desktop verification or openssl when Focus users report trust warnings.

Publish a short internal GIF showing padlock → Page Info → View Certificate so seasonal support hires do not reinvent steps during January certificate roundups.

European public-sector desks standardized on Firefox for policy reasons—train bilingual staff with localized screenshots while keeping openssl commands language-neutral.

When Firefox shows Peer’s Certificate issuer is not recognized, verify expiry anyway before chasing new intermediates; unknown issuer and expired leaf can coexist on misconfigured servers.

Library and kiosk Firefox profiles in permanent private browsing still allow certificate inspection when IT enables the setting—confirm kiosk images before assuming users cannot help triage.