How do I check the expiry date of an SSL certificate?
A certificate that expires takes the site down for every visitor at the same moment, with a full-page browser warning. Finding the date takes under a minute.
The quickest way is to open the site in a browser, click the padlock or site-information icon, choose the certificate details, and read the "Valid to" (notAfter) date. From a terminal, openssl s_client -connect example.com:443 -servername example.com piped into openssl x509 -noout -dates prints the same notBefore and notAfter dates. An online SSL checker does it without installing anything and also shows days remaining. The date shown is in UTC, so a certificate marked as ending on the 20th stops being valid during the evening of the 19th in India.
Three ways to read the date
| Method | Steps | Best for |
|---|---|---|
| Browser | Click the padlock, open the certificate, find "Valid to" / "Expires on" | A single site you can open |
| Command line | openssl s_client -connect host:443 -servername host, then openssl x509 -noout -dates | Servers, scripts and monitoring |
| Online checker | Type the hostname into an SSL checker | Sites behind a CDN, other people’s sites, a quick days-remaining figure |
The -servername flag matters. Without it, a server hosting many sites on one IP address may return its default certificate rather than the one for your domain, and you will read the wrong date.
What the fields in the output mean
| Field | Meaning | What to look at |
|---|---|---|
| notBefore | The moment the certificate becomes valid | A future date means a clock or issuance problem |
| notAfter | The last moment it is valid | This is the expiry date |
| Subject / SAN | The hostnames it covers | Make sure www and the bare domain are both listed |
| Issuer | The certificate authority | Tells you where to renew |
| Chain | Intermediate certificates sent with it | A missing intermediate causes errors even before expiry |
Why renewal windows keep shrinking
The maximum validity of a public TLS certificate has fallen from 398 days to 200 days from 15 March 2026 under CA/Browser Forum ballot SC-081, and is scheduled to drop to 100 days in 2027 and 47 days in 2029. A site that renewed once a year by hand now needs to renew at least twice, and soon four or more times. The schedule is laid out in how long an SSL certificate is valid. The practical conclusion is to automate: ACME clients renew certificates unattended, and the same applies to a wildcard certificate, which must renew over a DNS challenge.
If the date is already past or close
| Days left | Action |
|---|---|
| More than 30 | Nothing, but confirm automated renewal is actually configured |
| 30 to 14 | Start renewal now; check the contact email on the account |
| Under 14 | Treat as an incident; renew and reload the web server today |
| Expired | Renew, install, reload; then check every hostname, subdomain and CDN |
After installing a new certificate, check the live site again rather than trusting the install log. If the browser still complains once the dates are right, the cause is something else; why an SSL certificate is not trusted walks through the other failure modes in order of how often they occur.
Sources: IETF RFC 5280 (X.509 certificates, including the notBefore and notAfter validity fields), RFC 8446 (TLS 1.3), and the CA/Browser Forum Baseline Requirements.
Check your own numbers
Enter a hostname to see the issuer, the validity window and the days remaining.
Frequently asked
How many days before expiry should I renew?
With a 90-day Let’s Encrypt style certificate, automated renewal normally runs at 30 days remaining. For manually renewed certificates, start at 30 days and treat 14 days as the point of alarm: validation, payment approval and installation each take time, and a slip lands on a weekend easily. As maximum lifetimes fall under CA/Browser Forum ballot SC-081, manual renewal gets harder every year.
Will I get a warning before my certificate expires?
Only if something is set up to send one. Certificate authorities email the contact on the order, but that address is often an ex-employee or a shared mailbox nobody reads. Uptime tools that check certificates, and a calendar entry created on the day the certificate was installed, are the reliable options.
Why does the browser show a different expiry from my certificate file?
Because the server is not serving the file you think it is. The usual causes are a new certificate installed but the web server not reloaded, a CDN or load balancer holding an older certificate, or a second hostname that uses a different one. Check what the live host returns, not what is on disk.
What happens the moment a certificate expires?
Browsers show a full-page "Your connection is not private" error with NET::ERR_CERT_DATE_INVALID, and most visitors leave. APIs and mobile apps that validate certificates start failing, and search engines that fetch the page see the error. Renewing and reloading the server restores access immediately; there is no propagation delay on the certificate itself.
Related answers
Need domain and DNS checks inside your own product?
We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.
Request received
Thanks — we will reply within one business day. Meanwhile, all 164 tools are free to use, no signup.