How to Check an SSL Certificate Expiry Date (3 Easy Ways)

An SSL certificate is what lets your site load over https:// with the padlock. Every certificate has an expiry date. On that date, browsers stop trusting it and show visitors a full-page warning such as "Your connection is not private." Most people will leave rather than click through, and search engines and payment providers may treat your site as unsafe.

The good news is that checking the date takes under a minute, and you do not need a server login. This guide shows three ways, how to read the result, and what to do if the date is near or past.

Why certificates expire (and why the period is getting shorter)

Certificates expire on purpose. A short life limits the damage if a certificate key is stolen and forces regular re-validation of who controls a domain. Free certificates from Let's Encrypt are valid for 90 days. Browser and certificate-authority rules have been moving toward shorter maximum lifetimes for all certificates, so check your provider's current policy rather than assuming a year-long certificate.

That shorter lifespan is why renewal is usually automatic. But automation can fail silently: a changed DNS record, a moved server, an expired payment method, or a firewall rule can stop renewals, and nobody notices until the date arrives. If you want to know why a renewal fails, read Let's Encrypt renewal failures.

Method 1: Use an online SSL checker (easiest)

1. Open the SSL Checker.
2. Type your domain without https://, for example example.com. Use the exact name visitors use. If both example.com and www.example.com work, check both.
3. Run the check and read the results.

You should see:

• Valid from and valid to dates. The "valid to" date is your expiry.
• Days remaining. A quick sign of how urgent it is.
• Issuer. The company that issued the certificate, such as Let's Encrypt, Sectigo, DigiCert or Google Trust Services.
• Covered names. The domains the certificate protects. If your address is not listed, visitors will see a name-mismatch error.
• Chain status. Whether the intermediate certificates are installed correctly.

An outside checker tests what the public sees. That matters because the certificate stored on your server may differ from the one actually served, for example when a CDN sits in front.

If you manage several domains, the Bulk SSL Checker checks many at once. If the chain shows a problem, the SSL Chain Debugger explains missing intermediates.

Method 2: Check in your browser

Useful when you want to see exactly what a visitor's browser sees. Menus change between versions, so if you do not see these labels, look for the icon at the left of the address bar.

In Chrome or Edge

1. Open your site.
2. Click the icon at the left of the address bar (a padlock or a settings-style icon).
3. Choose the connection or "Connection is secure" option.
4. Choose "Certificate is valid" to open the certificate viewer.
5. Look for Valid from and Valid to (or "Expires on").

In Firefox

1. Click the padlock in the address bar.
2. Choose "Connection secure," then "More information."
3. Click "View Certificate" and read the validity dates.

In Safari

1. Click the padlock in the address bar, then "Show Certificate."
2. Expand the details and read "Expires."

The browser shows dates in your local time zone. An expiry of 23:59 on a date in one zone may be the next day elsewhere, so treat the date as approximate and renew a week or more early.

Method 3: Run one command (for the comfortable)

If you use a terminal (macOS, Linux, or Windows with WSL), OpenSSL shows the dates directly:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -issuer -subject

The output looks like this:

notBefore=Sep  2 00:00:00 2026 GMT
notAfter=Dec  1 23:59:59 2026 GMT
issuer=C = US, O = Let's Encrypt, CN = R11
subject=CN = example.com

notAfter is the expiry. The -servername option matters: many servers host several sites on one IP address and choose the certificate by name. Without it you may see the wrong certificate.

To see how many days remain, you can ask OpenSSL whether the certificate expires within a set number of seconds:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -checkend 1209600

It prints "Certificate will expire" if it expires within 14 days (1,209,600 seconds) and "Certificate will not expire" otherwise.

How to read the result

Use these rules of thumb:

Also confirm these three things, not only the date:

1. The name matches. The certificate must list the exact hostname visitors use.
2. The issuer is who you expect. If you thought your host manages it and the issuer is unknown, ask.
3. The chain is complete. A good date with a missing intermediate still fails on some devices.

If the certificate is close to expiring or has expired

1. Find who manages it. Is it your host, your CDN (such as Cloudflare), your website builder, or something you installed yourself? The renewal happens where the certificate is managed.
2. Try the renew or reissue option in your hosting panel, often named "SSL/TLS," "Let's Encrypt," or "AutoSSL."
3. Check that DNS and the domain still point to the right place. Renewals often validate by requesting a file from your site or checking a DNS record. If those checks fail, renewal fails.
4. Contact support if the button is missing or errors out.
5. After renewal, recheck with the SSL Checker. Browsers and CDNs sometimes cache the old certificate for a short time.

Our guides how to renew an SSL certificate and automate it and SSL and TLS certificate errors explained go deeper. If you see a specific warning in your browser, look it up under your connection is not private.

Get warned automatically

Checking by hand works only if you remember. Set a reminder, or let the monitor do it. The free uptime monitor includes SSL expiry alerts, along with 3 monitors, 5-minute checks and email, webhook, Slack and Discord notifications. Setup is in set up free uptime alerts. Also add certificate dates to your monthly health checklist.

When to call your host or developer

Ask for help when:

• The certificate has expired and you cannot find a renew option.
• The date is fine but visitors still see warnings. That may be a chain, name-mismatch or CDN-mode issue.
• You use a CDN and the certificate at the edge differs from the one on your server.
• Auto-renewal has failed more than once. Someone should read the renewal logs.
• You run several subdomains or a store with its own certificate and are unsure which is managed where.

Provide your domain, the screenshot of the warning, the expiry date and the issuer.

Next steps

• SSL Checker to read your certificate now
• Bulk SSL Checker for many domains at once
• How to renew an SSL certificate and automate it
• SSL certificate types explained
• Uptime Monitor for expiry alerts

FAQ

What happens when my SSL certificate expires?

Browsers show a full-page security warning and many visitors leave. The site content is still on your server, but most people will not reach it. Renewing and installing a new certificate fixes it.

How far ahead should I renew?

Aim for at least two weeks ahead, and make sure automatic renewal is turned on. Let's Encrypt renewals typically start well before expiry, so a certificate with only days left usually means something has failed.

Is the expiry date the same in every browser?

The certificate has one expiry moment, but browsers show it in your local time zone, so the date may look one day different. Renew early and the difference does not matter.

Does an expired certificate hurt SEO?

Search engines prefer working HTTPS, and an outage or warning page can reduce traffic while it lasts. Fix it quickly. See website downtime and SEO.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.