How to Check When an SSL Certificate Expires

To check an SSL certificate expiration date, inspect the certificate a website presents in your browser, run an OpenSSL command, or use an online SSL checker. Look for the certificate’s “Not After” date, compare it with the current time in UTC, and renew it before it expires.

An expired certificate can cause browser warnings or prevent secure connections. Checking the date is a simple maintenance task for site owners, developers, and anyone responsible for a web service. Here are reliable ways to do it and how to interpret what you find.

How to check an SSL certificate expiration date in a browser

A browser check is useful when you want to inspect the certificate currently served to visitors. The exact menu names vary by browser and version, but the process is similar:

1. Open the website using its HTTPS address.
2. Select the site information or security icon near the address bar.
3. Open the connection or certificate details. Depending on the browser, you may need to select a security or certificate option.
4. Find the certificate’s validity period, including its expiration or “valid to” date.

This method checks the certificate presented by that site to your browser at that moment. It does not necessarily tell you when a certificate file on a particular server expires if the site uses a proxy, content delivery network (CDN), or load balancer that serves a different certificate.

If you are only visiting a website, you do not need to install anything or enter personal information to view its public certificate. If the browser reports a certificate problem, do not ignore the warning or enter sensitive information until you understand the cause.

Use an SSL checker for a quick result

An online checker can summarize a website certificate’s validity, expiration date, issuer, and other details. Enter the public hostname you want to inspect, such as example.com, and review the result. For a quick browser-based check, use the ToolCMB SSL Checker.

Check the exact hostname visitors use. A certificate for www.example.com may not cover example.com, and a certificate for one subdomain does not automatically cover every other subdomain. The certificate’s subject names indicate which hostnames it covers.

A public checker typically inspects the certificate available at the hostname and network endpoint you provide. That makes it convenient for checking a live site, but it may not reveal certificates that are installed but not currently served. It also cannot confirm that your renewal process will succeed in the future.

Check an SSL certificate expiration date with OpenSSL

OpenSSL lets you inspect the certificate presented by a server from a command line. Run this command in a terminal, replacing example.com with the hostname you want to check:

openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

The output includes two lines: notBefore, when the certificate becomes valid, and notAfter, when its validity ends. The -servername option sends the hostname using Server Name Indication (SNI), which helps the server return the certificate configured for that site. The connection uses port 443, the standard port for HTTPS.

For example, if notAfter shows a date and time, compare that timestamp with the current time in UTC. OpenSSL installations and command-line behavior can vary across operating systems. On some systems, OpenSSL may not be installed or available in the terminal by default.

This command checks the certificate visible on the public endpoint. If your site is behind a CDN, reverse proxy, or load balancer, it checks the certificate served by that layer—not necessarily the certificate installed on the origin server. To inspect an origin directly, you would need to connect to its address and provide the hostname appropriately, while ensuring that you are authorized to access it.

What the certificate dates mean

Certificates have a validity period. The notBefore field marks the start, and notAfter marks the end. A certificate must be within its valid period for browsers and other clients to accept it, along with passing other checks such as hostname matching and trust-chain validation.

Expiration timestamps are commonly displayed in UTC, sometimes labeled GMT or shown with a Z at the end. Convert the time to your local time zone if needed, but plan against the UTC timestamp to avoid confusion. A date-only display may hide the exact time at which validity ends.

An unexpired certificate is not automatically a correctly configured certificate. It may still have the wrong hostname, an untrusted issuer, an incomplete certificate chain, or another configuration problem. Treat expiration as one important check, not a complete security review.

Which checking method should you use?

For routine checks, an online checker or browser is often enough. For diagnosis, compare the public result with the certificate and renewal status in your hosting or infrastructure panel.

How to avoid certificate expiration problems

1. Find every hostname you manage. Check the main domain, any www version, subdomains, and other services that use HTTPS.
2. Identify where TLS is handled. The certificate may be managed by your web host, a CDN, a load balancer, or your own server. Check the layer that presents the certificate to users.
3. Confirm renewal is configured. If certificates renew automatically, make sure the renewal service is running and the domain validation method still works. Automatic renewal is helpful, but it should not be assumed to have succeeded.
4. Set reminders or monitoring. Use a calendar reminder or an appropriate monitoring system to alert the responsible person well before the expiration date.
5. Verify after renewal. Check the public hostname again and confirm that visitors receive the renewed certificate. If the displayed certificate is still old, investigate caching, deployment, or which endpoint is serving it.

For sites with multiple servers or regions, check the relevant public endpoints rather than relying on one server’s local certificate file. A partial deployment can leave some visitors seeing an expired certificate even after a renewal appears successful in a control panel.

Common reasons an expiration check can be misleading

• Checking the wrong hostname: The root domain and a subdomain can use different certificates.
• Inspecting the origin instead of the public endpoint: A CDN or proxy may serve its own certificate to visitors.
• Reading local time as UTC: A timezone difference can make a certificate appear to expire earlier or later than expected.
• Assuming renewal means deployment: A new certificate may exist but not yet be installed or served by every endpoint.
• Checking only the expiration date: Hostname coverage, trust, and certificate-chain configuration also matter.

If a checker reports an expired certificate but your hosting dashboard shows a recent renewal, check the exact hostname and public endpoint again. You may need to reload the web server, update a CDN configuration, or correct a deployment step. Follow the instructions for the service that manages your certificate.

Frequently asked questions

How often should I check my SSL certificate expiration date?

Use automated monitoring where possible, and check manually after a renewal or infrastructure change. The right monitoring interval depends on your service and how certificate renewal is managed.

Can I check a certificate without owning the website?

Yes. A website’s public certificate can generally be inspected by visiting its HTTPS address or checking its public hostname with an SSL checker.

Does an SSL checker show the expiration date for every subdomain?

Not unless you check each hostname separately. A certificate may cover several names, but you should verify the hostnames your visitors and services actually use.

What happens when a certificate expires?

Browsers and other clients may warn that the connection is not secure or refuse the connection. The exact behavior depends on the client and service.

Is an unexpired certificate enough to prove a website is secure?

No. Expiration is only one check. The hostname, certificate chain, server configuration, and the website itself also affect security.