All tools

Free tool

SSL certificate checker

See when a site’s certificate expires, who issued it, and whether browsers trust it. Free, no account.

We check the certificate it serves on port 443.

Try example.com, expired.badssl.com or wrong.host.badssl.com.

What the result shows

Expires
The moment the certificate stops being valid, in UTC. Days left are counted in calendar days, so 0 means it expires today. After that, browsers show a full-page warning instead of the site.
Renewal
The certificate’s lifetime, from its start date to its expiry. For certificates of 100 days or less, also when renewal is normally expected: with about a third of the lifetime left, the point Let’s Encrypt recommends. If that date has passed and the server still sends this certificate, the result says renewal looks late. For a certificate from Let’s Encrypt, Google Trust Services, ZeroSSL or Sectigo, also the renewal window the CA itself suggests, asked live: these CAs publish one for their certificates through ACME Renewal Information (RFC 9773).
Issuer
The certificate authority (CA) that signed it, such as Let’s Encrypt, Sectigo or DigiCert, and the name of the intermediate it used.
Chain
Whether the certificates the server sends lead to a root certificate that browsers trust. “Missing intermediate” means the server sends its own certificate but not the one that links it to the root.
Hostname
Whether the domain you entered is one of the names on the certificate, directly or through a wildcard like *.example.com.
Protocol
The TLS version the server agreed to. TLS 1.2 and 1.3 are current; 1.0 and 1.1 are retired and flagged.
Names
Every hostname the certificate covers (its subject alternative names). One certificate often covers both example.com and www.example.com.
Fingerprint and serial
Identifiers for this exact certificate. Compare them with what your CA issued to confirm the server picked up a renewal.
Server addresses
The addresses we checked, up to 4 IPv4 and 4 IPv6, out of how many the domain has, and what each one served. Different valid certificates on different addresses are normal for CDNs. One that serves an expired or wrong certificate is a server that missed the renewal, and some visitors land on it. A load balancer behind one address may hide a bad server on a given day.
Domain (RDAP)
When the domain registration itself expires, from the registry. A valid certificate on a lapsed domain helps nobody.

Check certificate expiry from the command line

On any machine with OpenSSL, this prints the expiry date (notAfter) of the certificate a server sends:

Terminal 
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -enddate

The -servername flag matters: servers that host several sites pick the certificate by that name. More ways, including curl and the browser, are in how to check SSL certificate expiry.

When a certificate is close to expiry

  1. Find out how it renews. Most certificates renew automatically: certbot or acme.sh on a timer, a web server such as Caddy, or your host or CDN. Some are still bought and installed by hand.
  2. If it’s automatic, run the renewal yourself and read the output. With certbot, certbot renew --dry-run shows whether it would succeed. Common failures: DNS moved, port 80 blocked for the HTTP challenge, or expired API credentials for the DNS challenge.
  3. Make sure the server uses the new certificate. Reload the web server after renewing, and check every machine behind a load balancer and the CDN, not just one.
  4. Check again here. The new expiry date and fingerprint should show.
  5. Set up alerts so the next expiry doesn’t depend on someone remembering. That is what Expiry Watch is for.

Why expiry dates matter more now

Public TLS certificates are getting shorter. Since March 15, 2026, they can last at most 200 days; from March 15, 2027, 100 days; and from March 15, 2029, 47 days. Each step means more renewals, and more chances for one to fail quietly. Details are in 47-day SSL certificates: timeline and prep.

Let’s Encrypt also stopped sending expiry reminder emails on June 4, 2025, so a broken renewal no longer produces a warning in your inbox unless you set one up.

How the check works

We resolve the domain and connect to port 443 on each of its addresses from our checker, up to 4 IPv4 and 4 IPv6, completing a TLS handshake using the domain name, the way a browser would. We read the certificates each server sends, then disconnect. We don’t load the page, send any data or follow redirects.

The details at the top describe the certificate that expires soonest among the valid ones, since some visitors get it; the address list shows the rest. A CDN with regional edges can still serve different certificates in places our checker doesn’t reach, since we look from one place, and a load balancer behind one address answers with one of its servers, so a bad one may not show on a given day.

Questions

Something else? Send us a note, right from the page.

Is the SSL checker free?

Yes. Check as many domains as you like, with no account. Monitoring with email alerts is free for up to 10 domains.

Does a valid result mean my site is secure?

No. The check reads the certificate and its chain: dates, issuer, trust and names. It doesn’t scan for vulnerabilities or judge your server’s configuration beyond the TLS version it agreed to use.

My browser shows the padlock, but the checker says the chain is incomplete. Who is right?

Both. Chrome fetches a missing intermediate certificate by itself, and Firefox ships a list of known intermediates, so they cover for the server.

Most other clients don’t: curl, scripts, payment and webhook senders, many apps and monitoring tools. They fail until the server sends the full chain.

Which certificates count as trusted?

Our checker uses the root certificates bundled with Node.js, which come from Mozilla’s root store, the same list Firefox and many Linux systems use. A private or company root is reported as untrusted.

Why does it say “check unavailable” or “check failed”?

Unavailable means our checker didn’t answer in time; the registration details still show. Failed means we couldn’t complete a TLS connection: no DNS record, nothing listening on port 443, a firewall, or a server that doesn’t speak TLS.

Neither is a verdict on the certificate. We never show a failed check as expired.

Why does it say “4 of 6 addresses”?

Many sites answer on several IP addresses: a load balancer, several servers, or a CDN. We check each one, up to 4 IPv4 and 4 IPv6 addresses, the same ones every time, and the result lists what each served. Private or reserved addresses are never contacted.

If our checker can’t reach IPv6, those addresses show as not checked. That’s on our side, never counted against the site.

One address can also hide several servers behind a load balancer, and we see whichever answers us, so a bad server behind it may not show on a given day.

What is the CA’s suggested renewal window?

Some certificate authorities publish when they suggest renewing the certificates they issue: ACME Renewal Information, or ARI (RFC 9773). ACME clients that read it renew within that window. For certificates from Let’s Encrypt, Google Trust Services, ZeroSSL and Sectigo, the result shows the window, asked from the CA with each check.

A CA moves a certificate’s window earlier when it wants it replaced sooner, often ahead of a revocation. When a window has already started well before the point the same CA usually suggests for a certificate of that lifetime, the result flags it, for certificates of 90 days or more. It is what the CA publishes, not a verdict on the certificate.

Can I check an IP address, a non-standard port or an internal site?

No. The checker connects only to public domain names on port 443, and refuses addresses in private, internal or reserved ranges.

Do you keep the domains I check?

We don’t keep a history of your checks or tie them to you. Registry answers are reused for up to 12 hours so repeat lookups are quick, then deleted within a week, and like any web service our request logs are kept for a few days.

Get an email before it expires.

Expiry Watch checks the domain every day and emails you if the certificate’s renewal looks late, or before the certificate or the registration runs out.

Free for up to 10 domains. We confirm your address first, and every email has a one-click unsubscribe.

One quick check

Cloudflare wants to confirm a person is sending this. Nothing is sent until it does.