Looking for a free SSL certificate checker online? The fastest way to check any domain's SSL expiry is our free tool — no signup, no install, results in under two seconds.
→ Check your SSL certificate now (free tool)
Paste any domain name and you'll instantly see: days until expiry, certificate issuer, the full chain validity, and whether the certificate is trusted by major browsers. It works for any publicly reachable HTTPS site.
An SSL/TLS certificate is a cryptographic credential that does two things: it proves your server is who it claims to be, and it enables HTTPS encryption between the browser and your server. Without a valid certificate, modern browsers show a hard warning that blocks most visitors from reaching your site.
Certificates expire by design. The maximum validity period has been progressively shortened by browsers and certificate authorities over the years — it was 5 years, then 2 years, then 1 year, and Apple has proposed a 47-day maximum. Short lifetimes reduce the window of exposure if a private key is compromised.
The practical consequence: every certificate you issue will eventually expire, and you must renew it before that happens.
The moment an SSL certificate passes its expiry date, every major browser — Chrome, Firefox, Safari, Edge — immediately shows a full-page certificate error. Visitors see "Your connection is not private" or "This site can't provide a secure connection." Most users do not click through. Your site effectively goes down for new visitors.
Search engines also detect expired certificates. A site that stays expired for more than a few hours can see crawling halt and rankings drop as Google's crawler stops indexing new content.
Three common failure scenarios:
Let's Encrypt certificates are typically renewed by a certbot cron job or an ACME client running on your server. If that job fails — the server is rebooted, a permission changes, a port 80 challenge can't complete — the renewal doesn't happen. The certificate expires. You find out when a user reports the error, usually at 2am.
Large organizations manage dozens or hundreds of subdomains. Staging, internal tools, partner portals, legacy marketing pages — each one has its own certificate. It's easy for one to slip through when the team that provisioned it moves on or the renewal process isn't centralized.
If you use a CDN (Cloudflare, Fastly, AWS CloudFront) or a load balancer (AWS ALB, GCP HTTPS LB), the certificate may be managed by the CDN rather than your server. These can and do expire if the auto-renewal fails, and the failure often isn't surfaced in your normal deployment tooling.
There are a few ways to check an SSL certificate. Here's a comparison:
| Method | What you get | Requires |
|---|---|---|
| SSL Cert Checker (free tool) | Expiry, issuer, chain, days remaining — instantly in browser | Nothing — no signup, no install |
| Browser padlock icon | Basic validity, not expiry date | Navigate to the site |
openssl s_client |
Full cert details, chain, raw output | Terminal + OpenSSL installed |
| curl with verbose flag | Expiry in header output | Terminal |
| SSLLabs Server Test | Deep security analysis (cipher suites, protocols) | Browser, takes 60–90 seconds |
For a quick expiry check — which is the most common need — an online SSL certificate checker is the fastest option. No terminal, no flags to remember, instant results.
If you prefer the terminal, here's the one-liner to check SSL expiry:
# Check expiry date for any domain
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -dates
# Output:
# notBefore=Jan 1 00:00:00 2026 GMT
# notAfter=Mar 31 23:59:59 2026 GMTThe notAfter field is your expiry date. This works from any Unix-like system with OpenSSL installed — which is most Linux servers and macOS.
A complete SSL checker should show more than just the expiry date. Here's what matters:
Our free SSL checker shows all of the above in a clean results view, with no account required.
A one-time manual check is useful for diagnosing an issue, but it doesn't protect you going forward. Certificates expire on a fixed date regardless of whether you remember to check. The right approach is automated monitoring that alerts you before expiry.
For most teams, a useful monitoring cadence is:
If you're using Let's Encrypt with certbot, the default auto-renews at 30 days but you still need to know if the renewal process fails. The only way to know is monitoring.
SSLWatch monitors your domains continuously and alerts you in Slack or email before your certificates expire. Never get surprised by an expired cert again.
Join the SSLWatch waitlist → Check a cert now (free)