How to check when an SSL certificate expires — and why it matters

When a website's certificate expires, visitors see a full-page security warning and most leave. Payment providers, apps and other services that connect to the site simply stop working. It is one of the most common avoidable outages, and checking takes seconds.

What a certificate does

An SSL/TLS certificate lets a browser confirm it is talking to the real site and encrypt the connection. For it to work, three things must be true: it must be within its validity dates, it must name the domain being visited, and it must chain up to a certificate authority that devices trust.

Check a certificate step by step

1. Enter the domain in the SSL Certificate Checker.
2. Read the expiry date and the days remaining.
3. Check who issued it and which names it covers.
4. Look at the chain result — whether devices will trust it.

Browsers do not let web pages read certificate details, so this check is made by this site's server, which connects to the domain and reads the certificate it presents. The domain is not stored, and only public addresses can be checked.

When to worry

Renew with at least two weeks to spare. Automated clients such as Certbot for Let's Encrypt usually renew when about 30 days remain, so a certificate with fewer than 30 days left often means automatic renewal has stopped working — a full disk, a changed DNS record, a firewall rule or an expired account. Investigate then, not on the last day.

Chain problems your browser hides

A server should send its certificate together with the intermediate certificates linking it to a trusted root. If an intermediate is missing, desktop browsers can often fill the gap from their cache or by fetching it, so the site looks fine. Phones, apps, payment providers and other servers often cannot, and refuse to connect. A chain warning is worth fixing even when your own browser shows a padlock.

Check every name

The bare domain and www, and every subdomain that serves visitors — shop, api, mail — can each use a different certificate, or none. A certificate must name the exact host, or cover it with a wildcard such as *.example.com. Check each one separately.

Lifetimes are getting shorter

Under rules agreed by browser makers and certificate authorities, the maximum lifetime of public certificates is being reduced in stages — to 200 days from March 2026, falling to 47 days by 2029. Renewing by hand once a year is no longer viable; automated renewal, plus a regular independent check like this one, is the safe arrangement.

Mail servers

Mail servers use certificates too. The checker can test ports that use TLS from the first byte — 465 for sending mail, 993 for IMAP and 995 for POP3. Ports that upgrade a plain connection, such as 25 and 587, are not supported.

While you are checking

A site's health is more than its certificate. The Open Graph Preview shows how its links look when shared, and the Robots.txt Generator and Tester confirms search engines can reach its pages.