Free tool

SSL certificate expiry checker

Type a website address to see when its SSL certificate expires, who issued it, which names it covers and whether browsers will trust it. Free, no signup.

Updated October 12, 20264 min read

Paste a website address and see in a second when its certificate ends, who issued it and whether browsers will accept it.

What does the SSL certificate checker show?

When the certificate expires and how many days are left. Under 15 days is marked due soon, and a date in the past is marked expired.
When it was issued and by which certificate authority.
The names it covers, so you can see whether the main domain, www and any subdomains are on it.
Whether browsers trust it. A certificate can be in date and still fail trust checks, for example when the chain is incomplete.

Nothing you type is stored, and the lookup runs from our server, so it shows what a visitor on the public internet would get.

How do I read the result?

Result	What it means	What to do
More than 14 days left, trusted	Healthy	Nothing, but make sure renewal is automatic and watched
14 days or fewer	Due soon	Confirm that automatic renewal will run, or renew now
Expired	Visitors see a full-page browser warning	Renew immediately. See what to do when an SSL certificate expires
Not trusted	The date is fine but the chain or the name is wrong	Install the full certificate chain, or issue a certificate for the right name

How do I check a certificate from the command line?

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

The notAfter line is the expiry date. The checker above does the same lookup and adds the issuer, the covered names and the trust result.

Why do certificates expire?

Certificates have a limited life so that a stolen or mis-issued one stops working eventually, and so that identity checks are repeated. Public certificates are being limited in stages to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029, so renewal has to be automatic and watched. Confirm the current schedule with the CA/Browser Forum.

How do I stop certificates expiring unnoticed?

A one-off check tells you about today. To be warned before a date passes, track every certificate and domain in one place. Our guide on tracking domain and SSL expiry dates explains the process, and the domain expiry date checker does the same for domain registrations.

Where Datumboard fits

Datumboard checks the certificate of every site you add on a schedule, shows the dates in one renewal calendar and warns you before they pass, so you do not have to remember to come back to a checker. It is in early access, and you can join the list below.

Frequently asked questions

How do I check when an SSL certificate expires?

Enter the website address in the checker above. It connects to the site on port 443, reads the certificate the server presents and shows its end date and the days left. You can also read it in a browser's certificate details or with the openssl command in our guide.

Why does the checker show a certificate as not trusted when it is in date?

Being in date is only one condition. A browser also needs a complete chain back to a trusted authority and a name that matches the site. An incomplete chain, a certificate for a different name or a self-signed certificate is not trusted even before its end date.

Does the checker work for subdomains?

Yes. Each hostname presents its own certificate unless one wildcard certificate covers them, so check the exact hostname your visitors use, such as www or shop.

What does the checker not do?

It only checks port 443 over the public internet, and it does not test email or other services that use certificates. It looks at the certificate presented to a standard request, which can differ behind a load balancer that serves several certificates.