To check when a site’s SSL certificate expires, enter the domain in our SSL Certificate Checker: it shows the expiry date, the days left and the full certificate chain. In a browser you can open the padlock or site-information icon and view the certificate’s Valid to date, and on the command line OpenSSL prints it with one command. Because certificate lifetimes are getting shorter every year, the safest approach is automatic renewal plus a reminder that warns you well before the date.
Check it online
An online check is the quickest way to see what visitors see, including whether the server sends the intermediate certificates. Our SSL Certificate Checker connects to the site on port 443 and shows:
- who the certificate was issued to and which names it covers (SAN);
- the issuing authority and the validity period, with the number of days left;
- the TLS version and cipher suite of the connection;
- the certificate chain, and a warning when an intermediate certificate is missing.
Check it in your browser
| Browser | Steps |
|---|---|
| Chrome / Edge | Click the site-information icon left of the address → Connection is secure → Certificate is valid. The Validity Period shows “Expires on”. |
| Firefox | Click the padlock → Connection secure → More information → View Certificate, then read Not After. |
| Safari | Click the padlock → Show Certificate and expand Details. |
The browser shows the certificate it received from the nearest server. On sites behind a CDN such as Cloudflare this is the CDN’s certificate, which is usually renewed automatically; the certificate on your own origin server can still expire without visitors noticing until the CDN refuses to connect.
Check it from the command line
OpenSSL (Linux, macOS, Windows with OpenSSL installed):
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -subject -issuer -datesThe notAfter= line is the expiry date. -servername matters: without it, servers hosting several sites may return a different certificate. To check a certificate file on disk, use openssl x509 -in cert.pem -noout -enddate.
PowerShell (Windows):
$req = [Net.HttpWebRequest]::Create("https://example.com")
$req.GetResponse().Dispose()
$req.ServicePoint.Certificate.GetExpirationDateString()On a Windows server you can also open certlm.msc (Local Computer certificates) and look at the Expiration Date column under Personal → Certificates.
Certificates are getting shorter
The CA/Browser Forum, which sets the rules for public certificates, approved a gradual reduction of the maximum validity: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Let’s Encrypt certificates are already valid for 90 days. In practice this means manual renewal once a year no longer works:
- use automatic renewal (Certbot, win-acme, your hosting panel or your CDN);
- monitor expiry independently, because automation can fail silently after a DNS or server change;
- renew when about a third of the lifetime is left, not on the last day.
What happens when it expires?
Browsers show a full-page warning such as NET::ERR_CERT_DATE_INVALID, most visitors leave, and API clients and mail servers refuse to connect. If your certificate has just been renewed but visitors still see the old one, the web server has usually not been reloaded, or a load balancer or CDN still serves the previous certificate. Check again from outside with the SSL checker after every renewal. Other certificate problems are covered in SSL certificate errors explained.
Common Questions
How many days before expiry should I renew?
Automated clients such as Certbot renew when about 30 days are left on a 90-day certificate. As a rule, renew when roughly a third of the lifetime remains so there is time to fix problems.
Why does my browser show a different expiry date than my server?
Your browser may be connected to a CDN or load balancer that presents its own certificate. Check the origin server directly with OpenSSL, or compare the issuer shown in the browser with the certificate you installed.
Can I check the expiry date of an internal or private server online?
No. Online checkers can only reach public addresses. Use OpenSSL or PowerShell from inside your network for internal servers.
Does an expired certificate stop the site from loading?
The server still answers, but browsers block the page with a security warning and most automated clients refuse the connection, so in practice the site is unusable until the certificate is renewed.