Guides

How to check when an SSL certificate expires

Updated October 1, 2026

Every SSL/TLS certificate has an end date. After it, browsers show a full-page warning and many apps and APIs simply refuse to connect. Here are three ways to see when a certificate runs out.

1. In your browser

Open the site, click the padlock (or the site-information icon) in the address bar and choose the certificate details. In Chrome, Edge and Firefox the wording differs a little, but you are looking for Valid to or Expires on. This is quick for one site, but it only works for sites you can open in a browser, and it does not help with mail servers or other ports.

2. With one command

If you have openssl (Linux and macOS have it; on Windows it comes with Git Bash or WSL, but is not installed by default):

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

The output looks like notAfter=Dec 31 23:59:59 2026 GMT. A few details that matter:

• -servername sends the site name (SNI). Without it, a server that hosts many sites may show you the wrong certificate.
• For another port, change :443, for example mail.example.com:993 or example.com:8443. Services such as SMTP with STARTTLS need -starttls smtp and port 587 or 25.

3. With a free online checker

Type the domain into the CertAvert SSL checker. It shows the expiry date and days left, who issued the certificate, the other names on it, and whether the certificate is trusted and matches the name. It also shows when the domain registration itself runs out, which is a second date that surprises people. Nothing is saved and you don't need an account.

Checking once is not monitoring

Looking up the date tells you about today. Certificates are meant to be renewed automatically, and the usual way sites go down is that the automatic renewal quietly stopped working weeks ago and nobody noticed. Certificate lifetimes are also getting shorter across the industry, so there are more renewals to go wrong. The fix is to have something check regularly and tell you early. CertAvert does exactly that: add your domains (any port) and it emails you before a certificate expires. The free plan covers 3 domains.