How to Check SSL Certificate Expiration

Quick answer: how to check SSL certificate expiration

You can check SSL expiration by using the Website Certs SSL Checker, clicking the padlock icon in a browser, running OpenSSL from the terminal, or setting up automated monitoring that sends alerts before expiration.

The easiest path is a public SSL checker because it shows the expiration date, issuer, validity status, hostname match, and certificate chain health in one place. Browser checks are useful for quick manual inspection, OpenSSL is useful for engineers, and monitoring is best when you want reminders before a certificate becomes an outage.

1. Open the free SSL Checker.
2. Enter the domain name.
3. Review the expiration date, issuer, and validity status.
4. Set up monitoring if you want email alerts before expiration.

What is an SSL certificate expiration date?

An SSL certificate expiration date is the date and time when a certificate stops being trusted for HTTPS. Certificates are issued for a limited validity period. During that window, browsers can use the certificate to verify the hostname and create an encrypted connection.

After the expiration date passes, the certificate is outside its valid time range. Even if the certificate was trusted yesterday, browsers and API clients can reject it today. That is why the expiration date should be treated as an operational deadline, not just a detail in a certificate file.

Why SSL expiration matters

SSL expiration matters because certificate failures are visible to users before your application can respond. A checkout page, login screen, SaaS dashboard, API endpoint, or documentation site can become effectively unreachable even when the server is still online.

Expired certificates can also break webhooks, mobile apps, crawlers, uptime checks, and partner integrations. The failure can look like a network problem, but the root cause is trust: the client refuses the HTTPS connection because the certificate is no longer valid.

How to check SSL certificate expiration with Website Certs

Open the Website Certs SSL checker, enter the hostname you want to inspect, and run the public check. The result shows the certificate status, issuer, valid from date, valid until date, days remaining, SAN domains, hostname match, and chain validity.

Check the hostname people actually use. example.com and www.example.com can serve different certificates. Application subdomains such as app.example.com, api.example.com, and checkout.example.com should be checked separately if users or integrations depend on them.

• Go to /tools/ssl-checker.
• Enter the exact public domain or subdomain.
• Read the valid until and days remaining fields.
• Confirm hostname match and chain valid are both healthy.
• After renewal, run the check again to confirm the public endpoint serves the new certificate.

How to check SSL expiration in a browser

Most browsers let you inspect certificate details from the address bar. Open the HTTPS page, select the lock or site information control, open certificate details, and look for the validity dates. The label may say valid until, expires, not after, or something similar depending on the browser.

Browser checks are useful because they show what your browser receives. They are less convenient for monitoring many domains, and they may not show every detail as clearly as a dedicated SSL checker.

How to check SSL expiration with OpenSSL

OpenSSL can check a certificate from a terminal. Use this command with the exact hostname you want to inspect:

The output includes notBefore and notAfter. notBefore is the first date when the certificate is valid. notAfter is the expiration date, which is the value you need when checking SSL certificate expiry.

OpenSSL is useful for engineers and runbooks, but it is easy to check the wrong hostname if Server Name Indication is omitted. Always include the hostname as the SNI server name when checking modern HTTPS sites.

openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

• Use the exact hostname in both -connect and -servername.
• Look for the notAfter field.
• Compare the date against your alert thresholds.
• Recheck after renewal or deployment.

Common SSL certificate problems

Common problems include expired certificates, certificates that do not match the hostname, missing intermediate certificates, unexpected issuers, and servers that continue serving an old certificate after renewal. These issues often appear after CDN changes, hosting migrations, load balancer edits, or failed automation.

Use the SSL checker together with the HTTPS checker when troubleshooting. A certificate can be valid while the page still fails because of redirects, server errors, DNS routing, or TLS request problems. Use the DNS checker when you suspect the hostname points to the wrong endpoint.

• Expired certificate.
• Hostname mismatch.
• Untrusted or incomplete chain.
• Old certificate still served by a CDN or edge node.
• DNS points users to an endpoint with the wrong certificate.

How to monitor SSL expiration automatically

Manual checks are good for one-time validation. Automatic monitoring is better for production because SSL expiration is predictable but easy to miss. Website Certs can monitor domains during the free beta and help you catch expiration risk before visitors see warnings.

Use monitoring alongside related checks. The SSL checker confirms certificate health, the HTTPS checker confirms the endpoint responds correctly, the DNS checker shows routing records, and the Security Headers Checker verifies browser hardening after HTTPS is working.

For a deeper monitoring workflow, read the Website Certs guide to monitoring SSL certificates.

What to do if an SSL certificate is already expired

If visitors are already seeing browser warnings, treat the issue as an active incident. Check the public certificate, renew or reissue it, deploy the renewed certificate to the live endpoint, and verify the fix from outside your hosting provider.

The expired certificate fix guide walks through the recovery steps and the checks to run after renewal.