How to Check SSL Expiration Date
SSL certificate expiration is one of the most common causes of avoidable website outages.
This guide shows how to check SSL expiration date using browsers, command-line tools, online scanners, and monitoring platforms so you can catch problems before users do.
Whether you manage a single site or a large certificate inventory, knowing where to look and what to automate can prevent last-minute renewals, broken trust warnings, and lost traffic.
What SSL Expiration Means
An SSL certificate has a fixed validity period set by the certificate authority, such as DigiCert, Sectigo, GlobalSign, or Let’s Encrypt.
When the certificate expires, browsers and apps may show security warnings, block connections, or fail TLS handshakes entirely.
Expiration is not the same as revocation or misconfiguration.
A certificate can be valid by date but still fail if the hostname, intermediate chain, or private key is incorrect.
Why Checking Expiration Matters
- User trust: Browser warnings can drive visitors away immediately.
- SEO and uptime: Search engines and users may see instability if HTTPS fails.
- Payments and logins: Checkout and authentication flows often depend on valid TLS.
- Operational risk: Large organizations may have dozens or hundreds of certificates to track.
How to Check SSL Expiration Date in a Browser
For a quick manual check, most browsers display certificate details through the padlock or site information icon.
This method is useful for verifying a public website without any admin access.
In Chrome or Edge
- Open the website.
- Select the padlock icon in the address bar.
- Choose Connection is secure or the certificate details option.
- Open the certificate viewer and check the Valid from and Valid to dates.
In Firefox
- Click the padlock icon next to the URL.
- Select Connection secure.
- Choose More Information and view the certificate details.
- Look for the expiration date in the validity section.
Browser checks are convenient, but they are not ideal for automation or for validating multiple domains and subdomains.
How to Check SSL Expiration Date with OpenSSL
OpenSSL is one of the most reliable ways to inspect certificate validity from a terminal.
It works on Linux, macOS, and Windows environments where OpenSSL is installed.
Use this command to view the certificate dates for a remote site:
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -datesTypical output includes:
notBefore=Jan 1 00:00:00 2026 GMT
notAfter=Mar 31 23:59:59 2026 GMTThe notAfter field is the expiration date.
If you need to check a certificate file already stored on a server, use:
openssl x509 -in certificate.crt -noout -datesThis command is especially useful in DevOps workflows, CI pipelines, and incident response when you need accurate data fast.
How to Check SSL Expiration Date with cURL?
cURL does not directly print certificate expiration in a simple built-in report, but it can help confirm that a TLS connection succeeds and identify certificate issues indirectly.
For expiration details, OpenSSL or a dedicated scanner is usually better.
If you want a complete remote certificate check, pair cURL with a TLS inspection tool or use cURL only for connectivity testing during troubleshooting.
How to Check SSL Expiration Date in Linux
On Linux systems, OpenSSL is the standard option.
You can also combine it with shell scripts for monitoring multiple hosts.
for host in example.com api.example.com shop.example.com; do
echo | openssl s_client -connect "$host:443" -servername "$host" 2>/dev/null \
| openssl x509 -noout -dates
echo
doneThis approach works well for server administrators managing Apache, Nginx, HAProxy, or Kubernetes ingress endpoints.
It is also useful for checking certificates issued by Let’s Encrypt, which often have shorter lifetimes and require regular renewal.
How to Check SSL Expiration Date in Windows
Windows users can check expiration through browser certificate viewers, PowerShell, or third-party tools.
PowerShell is practical for certificate stores and remote endpoints if the environment supports TLS inspection scripts.
For local certificate files, you can inspect the certificate properties in the Microsoft Management Console or use tools such as OpenSSL installed via package managers like Chocolatey or winget.
In enterprise settings, Windows admins often rely on certificate management platforms, Active Directory Certificate Services, or endpoint monitoring tools to track expiration centrally.
How to Check SSL Expiration Date Online
Online SSL checker tools are helpful when you want a fast public-facing scan without opening a terminal.
They usually display the certificate chain, SAN entries, issuer, protocol support, and expiration date.
Common uses include:
- Checking a client website before launch
- Verifying a third-party vendor endpoint
- Auditing multiple subdomains
- Spotting intermediate chain issues
Examples of widely used tools include SSL Labs by Qualys, DigiCert SSL tools, and other browser-based certificate scanners.
Use reputable services only, since you are sharing hostname data with a third party.
How to Automate SSL Expiration Monitoring
Manual checks are fine for occasional verification, but automation is better for production environments.
Monitoring tools can alert you days or weeks before a certificate expires, giving your team time to renew and deploy safely.
Common automation options
- Uptime monitoring platforms: UptimeRobot, Pingdom, Datadog, New Relic
- Infrastructure monitoring: Prometheus with exporters, Grafana alerts, Zabbix, Nagios
- Cloud-native tools: AWS Certificate Manager, Azure Key Vault, Google Cloud Certificate Manager
- Certificate lifecycle management: Venafi, Sectigo Certificate Manager, DigiCert Trust Lifecycle Manager
Good alerting practices include notifying multiple people, creating a low-severity early warning, and confirming that renewal and deployment are both complete.
How Far in Advance Should You Renew?
Renewal timing depends on your certificate authority, automation process, and deployment complexity.
Many teams renew 30 to 60 days before expiration, even if the certificate itself remains valid longer.
Early renewal is especially important when certificates are deployed across load balancers, CDN edges, API gateways, and multiple regions.
Complex environments need enough buffer for testing and propagation.
Common SSL Expiration Problems to Watch For
- Renewed certificate not deployed: The CA issued the new cert, but the old one remains on the server.
- Wrong hostname: The certificate does not include the exact domain or subdomain in the SAN list.
- Missing intermediate certificates: Some clients cannot build the chain to a trusted root.
- Timezone confusion: Expiration is usually shown in GMT/UTC, which can differ from local time.
- CDN caching: A CDN or reverse proxy may still present an old certificate after renewal.
Best Practices for Tracking Certificate Expiration
Store all certificates in a centralized inventory with issuer, domain, deployment target, and expiration date.
That makes renewals easier to plan and reduces the risk of missing a hidden subdomain or internal service.
Use multiple layers of protection:
- Automated monitoring with alerts
- Calendar reminders for manual review
- Certificate inventory spreadsheets or CMDB entries
- Infrastructure-as-code for repeatable deployment
If you manage public-facing HTTPS services, it is also smart to test after renewal using a browser, OpenSSL, and an external scanner to confirm that the new certificate is live everywhere it should be.
What to Do When a Certificate Is Close to Expiring
If a certificate is within days of expiration, renew it immediately and verify deployment across all endpoints.
Confirm the certificate chain, hostname coverage, and any load balancer or CDN settings that may still reference the old file.
When time is short, prioritize the highest-traffic domains first, then move to internal applications and less critical environments.
After deployment, recheck the expiration date using the same methods you used to inspect it originally.