SSL certificate expiry checker
How many days are left on a site's certificate, who issued it, which names it covers, and whether browsers will trust it.
How it works
We open a secure connection to the site on port 443, the way a browser does, and read the certificate it sends. No page is requested.
- 1Read the certificateIssuer, the dates it is valid between, and every name it covers.
- 2Check it the way a browser wouldIs it trusted, does it cover the name you typed, and does the server send the full chain.
- 3Count the daysWarning under 30 days left, danger under 7, error once it has expired.
Worked example: a 90-day certificate for example.com
After a successful renewal the count goes back up to about 90 days. If it still reads under 30 days a week after it first does, renewal has probably failed.
Frequently asked questions
What happens when an SSL certificate expires?
Browsers show a full-page security warning and most visitors leave. Scripts and apps that call the site usually stop working until the certificate is renewed.
Why does the warning start at 30 days?
Most free certificates last 90 days and renew automatically around 30 days before they expire. If fewer than 30 days are left, automatic renewal may have failed, so it is worth a look.
What is an incomplete chain?
The server sends its own certificate but not the intermediate one that links it to a trusted root. Some browsers fill the gap, others refuse, so the site may work for you and fail for someone else.
What does “Name mismatch” mean?
The certificate doesn't list the name you checked. For example, it covers www.example.com but not example.com. Add the missing name to the certificate.
Can I share the result?
Yes. Copy link gives an address with the hostname only. Anyone who opens it runs a fresh check.