How do I check when an SSL certificate expires?

Enter the hostname above and read the Expires and Days left lines. From a terminal you can run: openssl s_client -connect example.com:443 -servername example.com, piped into openssl x509 -noout -enddate.

Why does the checker say untrusted when my browser shows a padlock?

Usually the server is not sending its intermediate certificate. Browsers often fill the gap from their cache; API clients, older devices and this checker do not. Install the full chain file.

What does renewal overdue mean?

The certificate comes from an automated CA such as Let's Encrypt and has passed the point where its ACME client normally renews it (about a third of its lifetime left). It still works, but the automation has probably stopped.

Do you store the hostnames I check?

We count tool uses so we know the tool is being used, and we rate-limit by IP address. We don't add the host to any list or monitor it unless you create an account and add it yourself.

SSL certificate checker

What this checker reads

We connect to the host on port 443, send its name in the TLS handshake (SNI, so shared hosting and CDNs return the right certificate) and read the certificate chain the server presents. Nothing is installed and nothing is stored beyond an anonymous count of how often the tool is used.

Expires and days left: the certificate's notAfter date, counted in whole days from now. Negative means it has already expired.
Issued and lifetime: the notBefore date and the total validity period. A 90-day lifetime usually means an automated ACME certificate; 365 or 397 days usually means someone bought and installed it by hand.
Issuer: the certificate authority that signed it, such as Let's Encrypt, Google Trust Services, Sectigo or DigiCert.
Names (SAN): every hostname the certificate covers. Browsers only look at this list, not the old Common Name field.
Chain: whether the chain the server sends verifies against a standard set of trusted roots.
Hostname: whether the name you typed is actually on the certificate.
Renewal and 47-day ready: our reading of how this certificate gets renewed, explained below.

Reading a bad result

Most broken certificates fail in one of four ways, and each needs a different fix. The result panel names the one we saw.

Label	What it means	Usual fix
EXPIRED	The `notAfter` date has passed. Every browser shows a full-page warning.	Renew or reissue, then reload the web server so it serves the new file.
WRONG HOST	The certificate is valid, just not for this name. Common after adding a `www.` or a new subdomain.	Reissue with every hostname in the SAN list, or point the name at the right server.
UNTRUSTED	The chain doesn't verify: self-signed, or the server isn't sending its intermediate certificate.	Install the full chain (leaf plus intermediate). Many hosts call this the "fullchain" file.
NO CERT	We couldn't finish a TLS handshake: nothing on port 443, DNS points nowhere, or a firewall dropped us.	Check DNS and that the site actually serves HTTPS.

A missing intermediate is the sneaky one. Desktop browsers often paper over it by fetching or caching the intermediate themselves, so the site looks fine to you and breaks for API clients, older phones and monitoring tools. If this checker says UNTRUSTED and your browser says fine, that's probably why.

Why we look at renewal, not just expiry

An expiry date on its own tells you very little about an automated certificate. Let's Encrypt's FAQ says its default certificates last 90 days and recommends renewing them every 60. Certbot, the most common ACME client, renews once less than a third of the lifetime remains. So a healthy 90-day certificate should almost never show fewer than about 30 days left.

When one does, the automation has usually stopped: a changed DNS record breaks validation, a server move loses the cron job, a plugin update removes the renewal hook. Nothing tells you. The certificate keeps working for another few weeks and then it doesn't. That is why the checker marks Renewal: Overdue on an ACME certificate that is past its normal renewal point, even though the expiry date is still weeks away. For Let's Encrypt certificates we also read the ACME Renewal Information window the CA publishes, which is the authoritative answer to "when should this have renewed".

The 47-day ready line looks further ahead. Under CA/Browser Forum Ballot SC-081v3 the maximum lifetime of a public TLS certificate drops to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. A certificate renewed by an ACME client is ready for that. A certificate someone buys once a year and uploads by hand is not, and that work is about to happen eight times a year instead of once.

One check versus watching it

A single check answers "is it fine right now". The failures that hurt are the ones that happen next month, so ExpiryOwl re-checks every certificate every 6 hours and sends alerts at 30, 14, 7, 3 and 1 days, plus the day it expires, and as soon as a renewal looks overdue. If you look after more than a handful of sites, the bulk SSL checker checks up to 25 at once, and the subdomain certificate finder finds the hosts nobody wrote down.