SSL certificate expiry checkerSSL expiry check
Shows when your certificate expires, how many days are left and who issued it. Checks the apex and www separately and adds a calendar reminder.
What this check looks at
- One TLS handshake (no HTTP request)
- Expiry date and days left
- Issuer, covered names (SAN), lifetime
- Chain and hostname match
- Apex and www checked separately
What it reads and what it doesn't
One TLS handshake with your site; no HTTP request is sent. It reads the certificate's expiry and issue dates, issuer, covered names, whether the chain is trusted and whether it matches the domain. If you enter an apex domain, www is checked too.
When does an SSL certificate expire?
An SSL (TLS) certificate lets your site load over HTTPS, and it expires on a set date. Once it does, browsers show the site as not secure. Since 15 March 2026 publicly trusted certificates can be valid for at most 200 days, falling to 100 days in 2027 and 47 days in 2029 under a CA/Browser Forum decision. Certificates are renewed more often than ever, which makes the expiry date worth watching.
One TLS handshake with your site; no HTTP request is sent. It reads the certificate's expiry and issue dates, issuer, covered names, whether the chain is trusted and whether it matches the domain. If you enter an apex domain, www is checked too.
Certificate lifetime schedule (CA/Browser Forum SC-081)
- Until 15 March 2026
- Up to 398 days.
- From 15 March 2026
- Up to 200 days. The limit for certificates issued today.
- From 15 March 2027
- Up to 100 days.
- From 15 March 2029
- Up to 47 days. Manual renewal becomes impractical; automated renewal (ACME) is needed.
Common problems and how to fix them
Every issue this check can flag, why it matters and what to change in DNS.
Certificate expired
Why it matters: Browsers put a full-page security warning in front of the site; most visitors leave, and email and API clients refuse to connect.
What to do: Renew the certificate now and reload the server. If you use automated renewal, find out why it didn't run: certbot renew --dry-run.
sudo certbot renew --dry-runsudo systemctl reload nginxExpires within a week
Why it matters: Automated renewal usually runs 30 days before expiry. With a week left, renewal is most likely failing.
What to do: Renew now and check the renewal job's log.
Certificate doesn't match the domain
Why it matters: The domain isn't on the certificate, so browsers show a 'your connection is not private' warning.
What to do: Get a certificate that covers the domain (and www). With Let's Encrypt you can put both names on one certificate.
sudo certbot --nginx -d example.com -d www.example.comChain can't be verified
Why it matters: The server doesn't send the intermediate certificate, or the certificate isn't from a trusted authority. Some browsers, mobile apps and API clients can't connect.
What to do: Serve the full chain file (fullchain.pem), not just the certificate (cert.pem).
Let's Encrypt no longer sends expiry emails
Why it matters: Let's Encrypt shut down its expiration reminder emails on 4 June 2025. If automated renewal breaks, nobody warns you anymore.
What to do: Make sure automated renewal works, and track the expiry with separate monitoring or a calendar reminder.
Frequently asked questions
- How do I check when my SSL certificate expires?
- Enter your domain above to see the expiry date, days left and issuer. In a browser, the site information icon in the address bar also shows certificate details. On the command line: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
- How often do SSL certificates need renewing?
- Publicly trusted certificates issued since 15 March 2026 are valid for at most 200 days, falling to 100 days on 15 March 2027 and 47 days on 15 March 2029. Let's Encrypt certificates last 90 days and are renewed automatically 30 days before expiry.
- Can I get a warning before my certificate expires?
- The 'Add to calendar' button on this page downloads a reminder (.ics) for 14 days before expiry. With a free account and site monitoring, we email you before the certificate expires and track the new date after renewal.
- Do the apex domain and www need separate certificates?
- No; one certificate can cover both names. But if they're served by different servers or settings, they can carry different certificates. That's why we check www separately when you enter an apex domain.
Primary sources
More quick checks
Each one answers a single question about a single record. No account needed.
SPF record check
Expands your domain's SPF record through every include, counts the DNS lookups it spends and flags the mistakes that send your mail to spam.
DKIM record check
Finds your DKIM signing key in DNS, reads its type and length, and flags keys that are weak, stuck in test mode or revoked.
DMARC record check
Breaks your DMARC record down tag by tag: what happens to spoofed mail, where reports go and whether external report addresses are authorized.
MX lookup
Shows which servers receive email for your domain, in priority order, with each server's address, reverse DNS and provider.
Is it down?
Tries to open the site from two separate locations and tells you whether it's down for everyone or just for your connection.
To see every check in one report:SSL/TLS check