How to Check SSL Certificate Expiration
Expired certificates are still one of the most common causes of website and API outages. This guide shows three ways to check when a certificate expires — from a quick online check to automated monitoring.
Check a live website
The fastest way is an online certificate checker: enter the hostname and it connects to the server, reads the certificate chain and shows the exact expiry date along with key size, SANs and chain details. This also verifies you are seeing the certificate actually served — not the one you think you deployed.
Check with OpenSSL
From a terminal: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates. The notAfter line is the expiry. For a local file, use openssl x509 -in cert.pem -noout -enddate.
Automate it
Checking manually works until someone forgets. Set up expiry monitoring that emails you well before the deadline — 30 days gives time for CA validation, and monitoring the certificate actually served in production catches deployment mistakes that calendar reminders miss.
Check any live site or certificate file now — expiry date, key strength, SANs and chain details in seconds.
Open the Certificate Checker →Frequently asked questions
How long are SSL certificates valid?
Public TLS certificates are capped at 398 days, and the CA/Browser Forum has scheduled further reductions — toward 47-day maximum validity by 2029 — which makes automation increasingly necessary.
When should I renew my certificate?
Start at least 30 days before expiry. That leaves room for CA validation, deployment across all systems, and fixing surprises — without risking the deadline.
Why did my site break if I renewed the certificate?
Renewing is not deploying. The new certificate must be installed everywhere the old one was used — web servers, load balancers, CDNs — and served with its full chain. An online checker verifies what is actually live.
Need help beyond the tools? MI Support IT provides enterprise PKI consulting — ADCS, Venafi automation, key ceremonies and CP/CPS documentation.