How to Check an SSL Certificate Expiration Date (4 Ways)

To check when an SSL certificate expires, type the domain (just example.com, no https://) into our free SSL lookup and read the Expiring on row. On the command line, openssl s_client piped into openssl x509 -noout -enddate prints the same date as notAfter. The lookup is free, needs no account and works in any browser, with nothing to install.

Below are four ways to find the date, with real results from checks we ran on October 29, 2026. The second half covers what the expiry date can't tell you, because a certificate can be well within its dates and still trigger a browser warning.

Four ways to check an SSL certificate expiration date

• Online SSL lookup: fastest, works on a phone, and checks the certificate the public internet actually sees.
• Your browser: good for a one-off look at the site you're on.
• openssl: the standard on Linux, macOS and servers, and scriptable.
• curl: handy when you're already debugging HTTP requests.

Method 1: Check the expiry date online

1. Open the SSL lookup.
2. Enter the host name only: example.com or shop.example.com. If you paste a full URL, the tool strips it down to the host.
3. Leave the port at 443 for websites. Change it only for other TLS services (see below).
4. Click Submit and read Expiring on. Dates are shown in UTC.
5. Subtract today's date to get the days left, and put a renewal check on your calendar well before that.

Worked example: mybotsy.com

We ran our own domain through the SSL lookup. This is the exact output:

How to read it:

• Expiring on is the certificate's notAfter date. On October 29 that left 53 days.
• Issued on to Expiring on is the lifetime: here exactly 90 days, typical of automated certificates.
• Organization, Common name and Country describe the issuer, not your site. WE1 is one of Google Trust Services' intermediate CAs. Don't expect to see your domain in the Common name row. To see which names the certificate covers, use the browser or openssl methods below.
• Status turns green when the current date falls between the two dates. It's a date check only (more on that below).

Why Google Trust Services? mybotsy.com sits behind Cloudflare, so visitors receive Cloudflare's edge certificate, and Cloudflare obtains those from public CAs such as Google Trust Services. If your site uses a CDN, any public check shows the CDN's certificate. The one on your origin server has its own expiry date and needs its own check.

Checking mail servers and other ports

The port field lets you check services that speak TLS from the first byte. We checked smtp.gmail.com on port 465 (SMTP over TLS): issued 7 October 2026, expiring 30 December 2026, issuer Google Trust Services WE2. Other direct-TLS ports include 993 (IMAP) and 995 (POP3). Ports that start in plain text and upgrade with STARTTLS, such as 587 and 143, need openssl s_client -starttls smtp (or imap) instead, because the lookup expects TLS straight away.

Method 2: Check it in your browser

Every major browser shows the certificate for the page you're on. Labels shift a little between versions, but the path is roughly:

• Chrome and Edge: click the icon to the left of the address, then Connection is secure, then Certificate is valid. The Validity Period section shows Expires On.
• Firefox: padlock, Connection secure, More information, View Certificate. Look for Not After.
• Safari: padlock, Show Certificate, then the expiry date under details.

The browser view also lists the Subject Alternative Names, the exact host names the certificate covers. The catch: you only see the certificate your browser received. A CDN, a load balancer or a stale certificate on one of several servers can mean other visitors get something different.

Method 3: Check it with openssl

On Linux, macOS or Windows (WSL or Git Bash), this connects to the server and prints both dates:

echo | openssl s_client -connect mybotsy.com:443 -servername mybotsy.com 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

Our output:

subject=CN=mybotsy.com
issuer=C=US, O=Google Trust Services, CN=WE1
notBefore=Sep 23 07:23:13 2026 GMT
notAfter=Dec 22 08:21:51 2026 GMT

It matches the online lookup to the second. Two details matter:

• Always pass -servername. It sends SNI, which tells a server hosting many sites which certificate you want. Without it, a shared host can hand you a different site's certificate, and you'll read the wrong date.
• echo | closes the connection right away, so the command doesn't sit waiting for input.

Add -ext subjectAltName to the second command to list covered names. For mybotsy.com it printed DNS:mybotsy.com, DNS:*.mybotsy.com.

Warn me if it expires soon: -checkend

-checkend takes a number of seconds and exits with status 1 if the certificate expires within that window. That makes it perfect for cron jobs and CI:

... | openssl x509 -noout -checkend 2592000   # 30 days
Certificate will not expire                 (exit status 0)

... | openssl x509 -noout -checkend 7776000   # 90 days
Certificate will expire                     (exit status 1)

Both lines are from the same mybotsy.com certificate with 53 days left. It's safe for the next 30 days, but not the next 90.

Check a list of domains and print days left

Put one host per line in hosts.txt and run:

while read -r host; do
  end=$(echo | openssl s_client -connect "$host:443" -servername "$host" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
  if [ -z "$end" ]; then echo "$host  no certificate"; continue; fi
  days=$(( ( $(date -d "$end" +%s) - $(date +%s) ) / 86400 ))
  echo "$host  $end  $days days left"
done < hosts.txt

Our run:

mybotsy.com  Dec 22 08:21:51 2026 GMT  53 days left
expired.badssl.com  Apr 12 23:59:59 2015 GMT  -4217 days left
wrong.host.badssl.com  Dec 28 20:02:55 2026 GMT  60 days left

date -d is GNU syntax. On macOS, install coreutils and use gdate -d. The certificate file on disk works too: openssl x509 -in cert.pem -noout -enddate.

With curl

curl -svI https://mybotsy.com 2>&1 | grep -i "expire date" printed expire date: Dec 22 08:21:51 2026 GMT. curl also refuses invalid certificates. For both expired.badssl.com and wrong.host.badssl.com it exited with code 60 (certificate problem). That exit code is easy to test in scripts.

What an expiry date doesn't prove

We tested the badssl.com test hosts, which are deliberately broken, to show what a date check catches and what it misses.

Expired: caught

expired.badssl.com in the SSL lookup showed a red status, issued 9 April 2015, expiring 12 April 2015. openssl agreed: Verify return code: 10 (certificate has expired).

Wrong host name: not caught by dates

wrong.host.badssl.com showed a green status, expiring 28 December 2026. Yet browsers reject it. Adding -verify_hostname wrong.host.badssl.com to openssl returned Verify return code: 62 (hostname mismatch). The certificate covers *.badssl.com and badssl.com, and a wildcard matches exactly one label. www.badssl.com is covered, while wrong.host.badssl.com has two labels before the domain, so it isn't.

Broken chain: not caught by dates

With openssl, self-signed.badssl.com returned code 18 (self-signed certificate), untrusted-root.badssl.com code 19, and incomplete-chain.badssl.com code 21 (unable to verify the first certificate). Code 21 is the classic missing-intermediate mistake. Some desktop browsers can patch around it, but many apps, API clients and older phones fail.

The takeaway: use the expiry date to plan renewals. To confirm a certificate is fully valid, check that the name is covered and that Verify return code: 0 (ok) appears in openssl with -verify_hostname, or that curl exits cleanly.

Certificate lifetimes are getting shorter

The CA/Browser Forum's Ballot SC-081v3 caps public TLS certificates issued from March 15, 2026 at 200 days. The cap drops to 100 days on March 15, 2027 and 47 days on March 15, 2029. Most certificates we checked already sit well below that: 90 days for mybotsy.com and for the Let's Encrypt certificate on badssl.com, and 84 days for Gmail's SMTP certificate. Renewing by hand once a year is no longer workable, so automated renewal (ACME clients like Certbot, or your host's or CDN's auto-SSL) is the default, and checking the date becomes a way to confirm the automation still works.

Expiry coming up? A quick troubleshooting checklist

• Renewed, but the old date still shows? The web server may still be serving the old certificate. Nginx and Apache load certificates when they start or reload, so reload after renewal. Also check every server behind a load balancer.
• Behind a CDN? Check the edge certificate (any public lookup) and the origin certificate separately.
• Automatic renewal failing? A CAA record that doesn't list your CA blocks issuance. Check CAA with the DNS lookup, and see our guide to checking DNS records.
• Don't confuse it with domain expiry. The domain registration has its own date, which you can see in the Whois lookup. When the domain lapses, a valid certificate won't help.
• After the fix, confirm http:// forwards to https:// with the URL redirect checker (our 301 vs 302 guide explains the codes). Then look for a strict-transport-security header in the HTTP headers lookup.

Check yours now: open the SSL lookup, enter your domain and note the Expiring on date. It's free and needs no sign-up, and the HTTP/2 checker and the other site tools work the same way.

Frequently asked questions

How do I check when my SSL certificate expires?

Enter your domain in the free My Botsy SSL lookup and read the Expiring on row, shown in UTC. On a terminal, run openssl s_client with -servername and pipe it into openssl x509 -noout -enddate to see the notAfter date.

What happens when an SSL certificate expires?

Browsers show a full-page warning, such as Chrome's Your connection is not private, and most visitors leave. API clients, apps and tools like curl refuse to connect at all. Nothing is fixed until a new certificate is installed and the server reloads it.

How long is an SSL certificate valid?

Public certificates issued from March 15, 2026 can last at most 200 days. The cap falls to 100 days in March 2027 and 47 days in March 2029. Many, including Let's Encrypt and Google Trust Services certificates, already last about 90 days.

Why does my site show an old expiry date after renewal?

Usually the web server wasn't reloaded, one server behind a load balancer still has the old file, or you're checking a CDN edge certificate instead of your origin. Reload the server, then check again with -servername.

Does a valid expiry date mean my SSL is working?

No. A certificate can be within its dates and still fail if it doesn't cover the host name or the chain is incomplete. Check with openssl -verify_hostname or curl, and look for verify return code 0.

Is the SSL lookup free?

Yes. It's free and needs no account. Guests get several free checks a day, and a free My Botsy account removes the daily limit.