SSL Certificate Expiry Checker

Check the certificate a server is serving right now

Certificate Transparency shows certificates that were issued, not necessarily the one a server presents today (an old certificate can still be installed after a renewal, or a load balancer can serve a different one). To read the live certificate, run this from any machine with OpenSSL:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

For a mail server use -starttls smtp -connect mx.example.com:25, and for another port change :443. notAfter is the expiry date.

How to use it

1. Enter a hostname such as www.example.com (a URL or email address works too; only the host part is used).
2. Click Check certificates. Your browser asks the Cert Spotter Certificate Transparency API for every unexpired certificate issued for that name. If Cert Spotter is rate limited or down, it falls back to crt.sh.
3. The top box shows the most recently issued certificate that covers the exact hostname (directly or through a wildcard), its expiry date and days left. Below it every current certificate is listed, soonest expiry first: red under 7 days, yellow under 30, green otherwise.
4. Tick Include subdomains to get an inventory of every name in current certificates under the domain. It is a quick way to find forgotten hosts, old staging sites and certificates someone else requested.
5. Confirm what a server actually serves with the openssl s_client command, which updates for the hostname you checked.

Related tools

Look up the CAA records that control which CAs may issue for your domain with DNS Lookup, or check that a new record has reached public resolvers with the DNS Propagation Checker. Securing mail servers? See the MTA-STS Policy Generator.

FAQ

How do I check when an SSL certificate expires?

Enter the hostname above to see every current certificate public CAs have issued for it, with expiry dates and days left. To read the certificate a server is serving right now, run: echo | openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates and look at notAfter.

What is Certificate Transparency?

Certificate Transparency (CT) is a set of public, append-only logs. Browsers only trust publicly issued TLS certificates that have been logged, so nearly every public certificate shows up in CT within minutes. Cert Spotter and crt.sh index those logs and make them searchable.

Why does this page not connect to my server?

A web page cannot open a raw TLS connection to another server, so it cannot read the certificate a server presents. It uses CT logs instead, which list issued certificates. A server can still be serving an older certificate after a renewal, so confirm with openssl s_client or your monitoring.

How long are SSL certificates valid now?

Under CA/Browser Forum ballot SC-081 the maximum is 200 days for certificates issued from 15 March 2026, then 100 days from 15 March 2027 and 47 days from 15 March 2029. Let's Encrypt issues 90-day certificates, moving to 64 days by default on 10 February 2027 and 45 days on 16 February 2028. Automated renewal (ACME) is the only practical option.

Why do I see certificates I did not request?

Hosting providers, CDNs, email security gateways and SaaS platforms often request certificates for your names automatically. Unknown issuers or names can also point to shadow IT or a mis-issued certificate. Restrict issuance with a CAA record and review the subdomain inventory regularly.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.