Every SSL/TLS certificate has an expiry date written into it. When that date passes, browsers block the site with a full-page warning and API clients refuse to connect. Checking the date takes ten seconds. Here are four ways to do it, from quickest to fully automatic.
1. In the browser
- Open the site and click the padlock (or "site information" icon) left of the address.
- Choose Connection is secure → Certificate is valid (Chrome/Edge) or More information → View certificate (Firefox).
- Read Valid to / Expires on.
Fine for a one-off check. It only shows the certificate your browser received from your location, though, and you have to remember to look.
2. With OpenSSL (any server, from the terminal)
This works on macOS, Linux and WSL, and checks exactly what the server sends:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \ | openssl x509 -noout -enddate # notAfter=Dec 30 23:59:59 2026 GMT
Always pass -servername. Without it, servers that host several sites (almost all of them, thanks to SNI) may return the wrong certificate.
More useful fields in one command - subject, issuer, all dates and the hostnames covered:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \ | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
Check whether it expires within the next 30 days (2,592,000 seconds). This is handy in scripts and CI:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \ | openssl x509 -noout -checkend 2592000 \ && echo "OK for 30+ days" || echo "Expires within 30 days!"
To check a certificate file on disk instead:
openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -enddate
3. With curl
curl -vI https://example.com 2>&1 | grep -iE "expire date|subject:|issuer:" # * expire date: Dec 30 23:59:59 2026 GMT
curl also fails loudly if the chain is broken or the hostname doesn't match, which is a useful second opinion.
Check more than the date
An in-date certificate can still break your site. While you're looking, check:
- Hostname match: is the domain (and
www) listed in the Subject Alternative Names? - Complete chain: is the intermediate certificate served? Desktop browsers often paper over a missing intermediate; Android, curl and many API clients don't.
openssl s_client -showcertslists what's sent. - Every endpoint: the apex,
www,api., the CDN edge and the origin can each have a different certificate with a different date. - TLS version: TLS 1.0 and 1.1 are obsolete; you want 1.2 or 1.3.
4. Automatically, with alerts
Manual checks don't scale past a handful of domains, and they fail in the most common way certificates expire: nobody remembers to look. Auto-renewal helps but fails silently more often than people expect - a DNS change breaks the ACME challenge, the renewed file is never reloaded by the web server, or a certificate was installed by hand years ago. (Why auto-renewal still fails.)
An SSL monitor checks every certificate on a schedule and warns you ahead of time. Upmonora's SSL monitoring records the issuer, common name, SANs, TLS version and expiry for each monitor, and alerts at 30, 14, 7 and 1 day before expiry - once per threshold, resetting automatically after renewal. It's included on every plan, including free.
Why this matters more every year
Certificate lifetimes are shrinking. Under CA/Browser Forum ballot SC-081, the maximum lifetime of a public TLS certificate fell from 398 to 200 days on March 15, 2026. It drops to 100 days in March 2027 and 47 days in March 2029. Renewals that used to happen once a year will happen every few weeks, and every renewal is a chance for automation to fail quietly. If you only check certificates by hand today, now is a good time to automate it.
Want a quick look at a site's SSL right now? The free website checker shows certificate validity alongside status and response time.
Frequently asked questions
How do I check when an SSL certificate expires?
Click the padlock in the browser address bar and open the certificate details, or run: echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate
How long are SSL certificates valid for?
Since March 15, 2026, new public TLS certificates are valid for at most 200 days. The limit drops to 100 days in March 2027 and 47 days in March 2029 (CA/Browser Forum ballot SC-081). Let's Encrypt certificates last 90 days.
What happens when an SSL certificate expires?
Browsers show a full-page security warning (NET::ERR_CERT_DATE_INVALID) and most API clients refuse to connect. The server keeps running, but for visitors the site is effectively down.
How do I get notified before my SSL certificate expires?
Use an SSL monitor that checks the certificate daily and alerts you at several thresholds, for example 30, 14, 7 and 1 day before expiry. Upmonora includes SSL monitoring on every plan, including the free one.
