SSL certificate expiry is one of the most preventable causes of downtime, yet it keeps happening to otherwise well-run teams. The certificate lifecycle is long enough that it falls outside normal operational awareness, and the failure mode is sudden and total: one moment the site is up, the next every browser shows a security warning and most users are gone.
This article explains why certificates expire unexpectedly, how to check expiry dates manually, and what an effective SSL monitoring setup looks like.
An expired SSL certificate doesn't just make your site unavailable to careful users. It triggers browser security warnings that effectively block the majority of your traffic — most users will not click past a "Your connection is not private" screen. The immediate impacts are significant:
Let's Encrypt and most modern certificate providers have pushed teams toward automatic renewal. So why do certs still expire? Three common failure patterns:
Certbot, acme.sh, and similar tools are scheduled to renew 30 days before expiry. But the renewal job can fail for many reasons: DNS validation errors because a record changed, port 80 blocked by a new firewall rule, rate limits from too many failed attempts, disk space issues, or a broken cron job. The tool exits with an error that nobody reads. The certificate ages toward expiry. No alert fires.
A wildcard certificate (*.example.com) protects all subdomains — which creates a false sense of coverage. When the wildcard cert expires, every subdomain fails simultaneously. Because any one subdomain "working" gives false confidence that certs are fine, teams often don't notice until multiple services go down at once.
As a company grows, certificates accumulate across multiple domains, subdomains, CDN providers, load balancers, and internal services. There's no central inventory. An obscure staging domain or an internal dashboard cert expires unnoticed for weeks before someone hits it.
The most direct way to check a certificate's expiry date from the command line:
# Check the cert served by a domain
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -dates
# Output:
# notBefore=Jan 1 00:00:00 2026 GMT
# notAfter=Mar 31 23:59:59 2026 GMTThe notAfter value is your expiry date. You can also script this to check multiple domains:
for domain in example.com api.example.com status.example.com; do
expiry=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null \
| openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
echo "$domain -> $expiry"
doneClick the lock icon in any modern browser, then "Connection is secure" → "Certificate is valid." The validity period is shown in the Details tab. Fast, but not scalable across many domains.
Our free SSL cert checker lets you paste in any domain and instantly see the certificate's expiry date, issuer, and days remaining — no command line required.
Paste in any domain and instantly see your certificate's expiry date, days remaining, and issuer — no login required.
Open the free SSL checker →Manual checks are useful for one-off investigations. A production SSL monitoring setup should be automated and alerting at multiple time horizons:
First alert fires 30 days before expiry. At this point, there's no urgency — but you should verify that auto-renewal is configured and test the renewal process in staging. If you're manually managing the cert, 30 days gives you time to schedule the work.
Second alert fires 14 days out. If auto-renewal should have triggered by now, check the certbot logs or your ACME client. Something may have already gone wrong.
Seven days before expiry, escalate. If the automatic renewal hasn't completed, take manual action. Do not wait and hope it resolves.
If the certificate is still not renewed 24 hours before expiry, this is an incident requiring immediate response. The same-day alert should wake someone up.
In addition to countdown alerts, a good setup actively verifies that the live certificate is valid — catching mismatches between what your CA issued and what your server is actually serving. A cert that was renewed but not deployed is just as broken as one that expired.
SSLWatch monitors your certificates continuously — tracking expiry dates across all your domains, alerting you at 30/14/7/1 day thresholds, and verifying that your server is actually serving a valid cert at every check.
Join the SSLWatch waitlist → Free SSL checker tool