What This Checker Looks At
It connects to the domain on port 443, the same way a browser does, and reads the certificate the server sends back. You get the five things that decide whether visitors see your site or a warning page:
- Expiry date and days left. The number that bites. An expired certificate takes the site down for every visitor at once.
- Issue date. Tells you whether automatic renewal has been working. A Let's Encrypt cert issued 80 days ago means renewal is overdue.
- Issuer. Who signed it: Let's Encrypt, Google Trust Services, Sectigo, DigiCert, and so on.
- Hostnames covered. Every name in the certificate's Subject Alternative Names list.
- Hostname match. Whether the exact name you typed is one of them. Wildcards are matched the way browsers match them.
How to Read the Result
Automated certificates (Let's Encrypt and most ACME clients) renew around 30 days before expiry. A certificate that's still unrenewed inside 30 days usually means the renewal job is failing, so treat amber as a real warning, not a reminder.
Common SSL Problems and the Fix
Expired certificate. Renew it (for certbot, certbot renew), reload the web server, then find out why it didn't renew on its own: a stopped timer, a blocked HTTP challenge, a DNS change, or a full disk. Fixing the cert without fixing the renewal just schedules the next outage.
Renewed, but the site still shows the old one. The web server is still holding the old certificate in memory. Reload or restart it (systemctl reload nginx). Load balancers and CDNs that had the certificate uploaded by hand need the new one uploaded too.
Hostname mismatch. Reissue the certificate with every name you serve, including www. Remember a wildcard covers one level only.
Works in a browser, fails in an app or API client. Usually a missing intermediate certificate. Browsers often fill the gap, strict clients don't. Serve the full chain (for certbot, fullchain.pem rather than cert.pem).
Why "Valid Today" Isn't Enough
Certificates are getting shorter. The maximum lifetime for a public certificate dropped to 200 days on March 15, 2026, goes to 100 days in 2027, and 47 days in 2029. Let's Encrypt certificates already last 90 days, and Let's Encrypt stopped sending expiry reminder emails in 2025.
More renewals, fewer reminders. A one-off check tells you about today. What prevents the outage is something that checks every day and tells you when renewal didn't happen.
SSL Certificate FAQ
How do I check when an SSL certificate expires?
Enter the domain in the checker above. It connects on port 443, reads the certificate the server presents, and shows the expiry date and the number of days left. From a terminal you can run: openssl s_client -connect example.com:443 -servername example.com, then pipe the output to openssl x509 -noout -dates.
What happens when an SSL certificate expires?
Browsers show a full-page security warning (NET::ERR_CERT_DATE_INVALID in Chrome) and most visitors leave. APIs, webhooks and mobile apps that call the site start failing outright, because they refuse the connection instead of showing a warning.
How long do SSL certificates last now?
Since March 15, 2026, publicly trusted certificates can be valid for at most 200 days. That drops to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt certificates last 90 days. Shorter lives mean more renewals, and more chances for one to fail.
Why does the checker show a different certificate than my server has?
If the site is behind a CDN or proxy like Cloudflare, the checker sees the CDN's edge certificate, not the one on your own server. The CDN renews its edge certificate automatically, so it can look fine while the origin certificate behind it is expiring. That origin expiry is what causes Cloudflare Error 526.
What does 'hostname mismatch' mean?
The certificate doesn't list the name you checked in its Subject Alternative Names. A common case is a certificate issued for example.com but not www.example.com, or a wildcard like *.example.com, which covers one level only (it covers www.example.com but not a.b.example.com and not example.com itself).
Does Let's Encrypt still send expiry emails?
No. Let's Encrypt stopped sending expiration reminder emails in 2025. If automatic renewal breaks, nothing tells you. You need your own monitoring.