--- title: Free SSL Expiry Checker description: Check when a site's SSL certificate expires — days left, the exact not-after date, the issuer and whether the chain is still trusted, from a real TLS handshake. Catch a renewal that silently stopped, a load balancer still serving the old certificate, or a wildcard about to lapse across every subdomain. canonical: https://watchfor.io/ssl-expiry-checker --- [Back to all free tools](/free-tools) # SSL Expiry Checker Check when a site's SSL certificate expires — days left, the exact not-after date, the issuer and whether the chain is still trusted, from a real TLS handshake. Catch a renewal that silently stopped, a load balancer still serving the old certificate, or a wildcard about to lapse across every subdomain. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is SSL Expiry Checker ? An SSL certificate has a hard end date, and the day it passes every browser shows a full-page warning and every API client refuses to connect. Certificates now live 398 days at most, Let's Encrypt's 90, and the industry is moving to 47 — so renewal is no longer an annual calendar entry but an automated process that fails quietly: the cron job that ran on the old server, the DNS validation record that was deleted, the load balancer that renewed and never reloaded. This tool does a real TLS handshake with any host and port, reads the certificate the server actually presents, and tells you how many days it has left, the exact expiry timestamp, the issuer, the names it covers and whether the chain is trusted. Not the certificate you uploaded — the one users get. ## How it works One handshake, no guessing: - 1 Connect with SNI — A TLS ClientHello to the host and port (443 unless you say otherwise) with the hostname in SNI, so a server hosting many sites returns the right certificate. - 2 Capture the chain — The leaf certificate and any intermediates the server sends. The expiry that matters is the leaf's, but an expired intermediate breaks the chain just as effectively. - 3 Validate and count down — Chain built to a trusted root, hostname matched against the SANs, validity window checked. The days-remaining figure is computed from the notAfter timestamp at the moment of the check. Run it from a specific probe location when a CDN or anycast setup might serve different certificates in different regions — an expired one in a single region is a thing that happens. ## When you'd use it ### Monthly certificate audit Check every public hostname you own. Anything under 30 days needs a look at its renewal automation; anything under 14 needs a human today. ### "Did the renewal actually deploy?" The ACME log says renewed. The handshake says the old certificate, because nginx wasn't reloaded or the load balancer still has the previous upload. This check settles it in two seconds. ### Non-443 services SMTP on 465, IMAP on 993, LDAPS on 636, MQTT on 8883, an internal API on 8443. Each has its own certificate and its own forgotten renewal. Enter the port. ### Vendor dependencies The payment gateway, the SSO provider, the webhook endpoint you call. Their expiry is your outage. Check the hosts your integrations depend on. ## Reading the result ### Days until expiry Green above 45 days, amber under 45, red under 14. Expired shows as negative days and an invalid chain. ### Not before / not after The validity window in UTC. A notBefore in the future — a certificate issued with a clock ahead of the server — is also "invalid", just from the other end. ### Issuer Which CA signed it. Useful when you're checking that a renewal moved to the intended CA, or spotting that a hostname is served by the CDN's certificate rather than yours. ### Subject alternative names Every hostname the certificate is valid for. A renewal that dropped a SAN breaks that name silently until someone visits it. ## Check it yourself echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates notAfter is the expiry in GMT. ## Common pitfalls ### Renewed but not reloaded The most common expiry incident: the file on disk is new, the process in memory serves the old one. Reload the web server or push the new certificate to the load balancer, then check again. ### Multiple certificates per host Different ports, different SNI names, different regions of a CDN. A single "the certificate is fine" can be true of one and false of the rest. ### Pinned certificates in mobile apps An app that pins the leaf breaks on every renewal, expired or not. Pin the CA or the public key instead — and know which apps do it before you rotate. ## Run SSL Expiry Checker on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions How do I know when my SSL certificate expires? Run this check for the hostname — the expiry comes from the certificate the server is serving right now, which is the only date that matters. Browsers show it under the padlock, but only for the site you're on. What happens when an SSL certificate expires? Browsers show a full-page warning that most users can't bypass, API clients and mobile apps fail with certificate errors, and search engines may drop the pages. Email clients warn on IMAP/SMTP. Nothing is "partly" down. How long do SSL certificates last? At most 398 days today for publicly trusted certificates, with 90 days common (Let's Encrypt) and the CA/Browser Forum reducing the maximum to 47 days by 2029. Automate renewal; nobody will remember a 47-day cycle. Why does the tool show a different certificate than my browser? SNI, region or port. The probe asks for the exact hostname from a specific location; your browser may hit a different CDN edge or have a cached connection. Try another probe location to compare. Can I get alerted before a certificate expires? Yes — an SSL/TLS monitor runs this same check on a schedule and alerts at thresholds you choose (30, 14, 7 days), from multiple locations. That is what WatchFor's certificate monitor does. Does an expired intermediate certificate matter? Yes: the chain fails to validate even if the leaf is fresh. Servers must send current intermediates; the check reports chain trust separately from the leaf's expiry. ## Related web tools - [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.](/ssl-checker) - [MCP Server CheckerTest a Model Context Protocol server: initialize handshake, protocol version, capabilities and the full tool inventory.](/mcp-server-checker) - [SSL/TLS GradeGrade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons.](/ssl-grade-checker) - [HTTP HeadersInspect response headers, status, redirect chain and security headers.](/http-header-checker) --- Canonical page: https://watchfor.io/ssl-expiry-checker · Site guide: https://watchfor.io/llms.txt