How to Check SSL Certificate Expiration

Check the live certificate in three steps

A renewed certificate in your hosting dashboard is not enough: visitors must receive it from the live HTTPS endpoint. Start with the exact hostname they use.

1. Open the free SSL Checker and enter the hostname, such as example.com or api.example.com.
2. Run the check. Read valid until and days remaining, then confirm hostname match and chain validity.
3. Check www and other important subdomains separately. After renewal, repeat the check and confirm that the public expiration date has changed.

How to read the expiration date

For example, imagine a check performed on October 14, 2026 at 12:00 UTC returns the dates below. The certificate expires on November 13 at 12:00 UTC, exactly 30 days later. This is an illustrative result, not a live check of example.com.

GMT in this output uses the same UTC offset as UTC. A browser may display dates in your local timezone. Use the full timestamp when comparing results, especially near expiration; a rounded days-remaining value is not an extra day of validity.

notBefore=Aug 15 12:00:00 2026 GMT
notAfter=Nov 13 12:00:00 2026 GMT

• Valid from / notBefore: the start of the certificate's validity period.
• Valid until / notAfter: the end of that period. Renew and deploy before this deadline.
• Days remaining: time until expiration, not a guarantee that hostname and trust checks pass.

What should you do with the result?

An expiration check and a complete certificate check answer different questions. A certificate with months left can still fail because it covers the wrong hostname or its chain is not trusted.

Check SSL expiration in a browser

Open the HTTPS URL and use the site information control beside the address. Open connection or certificate details, select the website's certificate, and find its validity dates. Labels vary by browser and may say expires, valid until, or not after.

Notice the hostname in the address bar after redirects. If example.com redirects to www.example.com, you may be inspecting the destination certificate rather than the original one. Use a hostname-specific checker to inspect both.

If a browser blocks the connection, inspect the warning and certificate details where available. Do not bypass warnings or enter credentials just to test the site.

Check SSL expiration with OpenSSL

With OpenSSL installed, run the command below in Bash, macOS Terminal, or WSL. Replace example.com in both places. The input redirection shown here is shell-specific and is not PowerShell syntax.

The -servername option supplies SNI so the server can select the intended certificate. The -dates output includes notBefore and notAfter. Diagnostic messages are deliberately not hidden.

This command displays dates; it does not prove that hostname and trust validation succeeded. If no certificate can be read, investigate the connection error rather than treating missing output as an expired certificate.

openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates

Check a local certificate file

For a PEM certificate file, use the first command to read its expiration date. The second tests whether it expires within 2,592,000 seconds (30 days).

For a successfully read certificate, -checkend returns zero when it will not expire within that window and nonzero when it will. File or parsing errors can also produce a nonzero exit code, so inspect diagnostics.

A local file check does not confirm what the server serves, nor validate the hostname or chain. Never upload or share a private key to check expiration.

openssl x509 -in certificate.pem -noout -enddate
openssl x509 -in certificate.pem -noout -checkend 2592000

Why two checks can show different dates

Check that you are comparing the same hostname and the same certificate. A CDN may terminate public TLS while your origin server uses a different certificate. A load balancer or one edge location may still serve an older certificate after renewal.

Different DNS answers, IPv4 and IPv6 endpoints, or a corporate TLS-inspection proxy can also produce different results. Compare issuer, serial number or fingerprint, SAN domains, and expiration time to identify whether the certificates actually differ.

• Check the root domain, www, and critical application subdomains individually.
• Verify deployment at the component that terminates public TLS, not only at the origin server.
• Use DNS records to investigate routing differences and HTTPS checks to investigate redirects or response failures.

If the certificate is already expired

Renew or reissue the affected certificate, install it with the required intermediate certificates, and reload or redeploy the service that terminates TLS. Then verify the public hostname again.

If the new date does not appear, investigate deployment and routing before requesting another certificate. Our recovery guide covers common renewal and deployment failures.

Turn a one-time check into monitoring

A manual check is a snapshot. For production domains, monitor regularly, send alerts to someone who can act, and verify the public certificate after each renewal. Monitoring detects problems; it does not renew or install certificates for you.

During the free beta, Website Certs lets you add domains and monitor SSL, HTTPS, and DNS from one dashboard. Start with the hostname you just checked.