--- title: Free SSL Expiry Checker description: Check when a site's SSL certificate expires — days left, the exact not-after date, the issuer and whether the chain is still trusted, from a real TLS handshake. Catch a renewal that silently stopped, a load balancer still serving the old certificate, or a wildcard about to lapse across every subdomain. canonical: https://watchfor.io/ssl-expiry-checker --- [Back to all free tools](/free-tools) # SSL Expiry Checker Check when a site's SSL certificate expires — days left, the exact not-after date, the issuer and whether the chain is still trusted, from a real TLS handshake. Catch a renewal that silently stopped, a load balancer still serving the old certificate, or a wildcard about to lapse across every subdomain. [How to use this tool](/blog/how-to-check-ssl-certificate-expiry) Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is SSL Expiry Checker ? An SSL certificate has a hard end date, and the day it passes every browser shows a full-page warning and every API client refuses to connect. Public certificates now live 200 days at most (since March 2026), Let's Encrypt's 90, and the maximum drops to 100 days in 2027 and 47 in 2029 — so renewal is no longer an annual calendar entry but an automated process that fails quietly: the cron job that ran on the old server, the DNS validation record that was deleted, the load balancer that renewed and never reloaded. This tool does a real TLS handshake with any host and port, reads the certificate the server actually presents, and tells you how many days it has left, the exact expiry timestamp, the issuer, the names it covers and whether the chain is trusted. Not the certificate you uploaded — the one users get. ## How it works One handshake, no guessing: - 1 Connect with SNI — A TLS ClientHello to the host and port (443 unless you say otherwise) with the hostname in SNI, so a server hosting many sites returns the right certificate. - 2 Capture the chain — The leaf certificate and any intermediates the server sends. The dates shown are the leaf's; an expired intermediate breaks the chain just as effectively, and shows up as an untrusted chain rather than a date. - 3 Validate and count down — Chain built to a trusted root, hostname matched against the SANs, validity window checked. The days-remaining figure is computed from the notAfter timestamp at the moment of the check. Run it from a specific probe location when a CDN or anycast setup might serve different certificates in different regions — an expired one in a single region is a thing that happens. ## When you'd use it ### Monthly certificate audit Check every public hostname you own. Anything under 30 days needs a look at its renewal automation; anything under 14 needs a human today. ### "Did the renewal actually deploy?" The ACME log says renewed. The handshake says the old certificate, because nginx wasn't reloaded or the load balancer still has the previous upload. This check settles it in two seconds. ### Non-443 services SMTP on 465, IMAP on 993, LDAPS on 636, MQTT on 8883, an internal API on 8443. Each has its own certificate and its own forgotten renewal. Enter the port. ### Vendor dependencies The payment gateway, the SSO provider, the webhook endpoint you call. Their expiry is your outage. Check the hosts your integrations depend on. ## Reading the result ### Days until expiry Green above 45 days, amber under 45, red under 14. An expired certificate fails the handshake, so there is no day count: the result says Expired and shows the reason. ### Not before / not after The validity window in UTC. A notBefore in the future — a certificate issued with a clock ahead of the server — is also "invalid", just from the other end. ### Issuer Which CA signed it. Useful when you're checking that a renewal moved to the intended CA, or spotting that a hostname is served by the CDN's certificate rather than yours. ### Subject alternative names Every hostname the certificate is valid for. A renewal that dropped a SAN breaks that name silently until someone visits it. ## Check it yourself echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates notAfter is the expiry in GMT. ## Common pitfalls ### Renewed but not reloaded The most common expiry incident: the file on disk is new, the process in memory serves the old one. Reload the web server or push the new certificate to the load balancer, then check again. ### Multiple certificates per host Different ports, different SNI names, different regions of a CDN. A single "the certificate is fine" can be true of one and false of the rest. ### Pinned certificates in mobile apps An app that pins the leaf breaks on every renewal, expired or not. Pin the CA or the public key instead — and know which apps do it before you rotate. ## Run SSL Expiry Checker on every change, not just once. Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions How do I know when my SSL certificate expires? Run this check for the hostname — the expiry comes from the certificate the server is serving right now, which is the only date that matters. Browsers show it under the padlock, but only for the site you're on. What happens when an SSL certificate expires? Browsers show a full-page warning that most users can't bypass, API clients and mobile apps fail with certificate errors, and search engines may drop the pages. Email clients warn on IMAP/SMTP. Nothing is "partly" down. How long do SSL certificates last? At most 200 days for publicly trusted certificates issued since March 2026, with 90 days common (Let's Encrypt). The CA/Browser Forum lowers the maximum to 100 days in March 2027 and 47 days in March 2029. Automate renewal; nobody will remember a 47-day cycle. Why does the tool show a different certificate than my browser? SNI, region or port. The probe asks for the exact hostname from a specific location; your browser may hit a different CDN edge or have a cached connection. Try another probe location to compare. Can I get alerted before a certificate expires? Yes — an SSL/TLS monitor runs this same check on a schedule and alerts at thresholds you choose (30, 14, 7 days), from multiple locations. That is what WatchFor's certificate monitor does. Does an expired intermediate certificate matter? Yes: the chain fails to validate even if the leaf is fresh. Servers must send current intermediates. The check shows that as a failed verification with the reason, not as the intermediate's date — list the chain with openssl s_client -showcerts to see which certificate expired. ## Related web tools - [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.](/ssl-checker) - [Software Exposure CheckerSee which software versions your website reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries — and whether any is outdated, past end of life or has known CVEs. Graded A+ to F, with the fix for each. One plain GET, no signup.](/software-exposure-checker) - [PHP Version CheckerCheck your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup.](/php-version-checker) - [MCP Server CheckerTest a Model Context Protocol server the way an agent does — initialize handshake, protocol version, HTTPS, sign-in discovery and the full tool inventory — and get an A+ to F grade with the exact fix for every problem. Open servers are never marked down for being open.](/mcp-server-checker) --- Canonical page: https://watchfor.io/ssl-expiry-checker · Site guide: https://watchfor.io/llms.txt