How to check when an SSL certificate expires
Every HTTPS certificate has a "Not After" date. Once it passes, browsers show a full-page security warning and most visitors leave.
In the browser
Click the icon to the left of the address bar, open the connection or certificate details, and look for Expires on or Valid until.
From a terminal
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \ | openssl x509 -noout -enddate
The -servername flag matters: servers that host many sites pick the certificate by hostname, and without it you may read the wrong one.
Is it renewing on schedule?
Most certificates now come from Let's Encrypt or another free, automated authority and renew themselves. Let's Encrypt issues 90-day certificates, and the usual clients (certbot, cPanel AutoSSL, managed hosts) renew about 30 days before expiry. So:
- More than 30 days left: normal.
- Fewer than about 20 days left on a Let's Encrypt certificate: renewal has probably been failing for a while. See why Let's Encrypt renewals fail.
- Name mismatch or the host's default certificate: the site was moved or its certificate was never installed, and browsers already warn visitors.
Lifetimes are getting shorter
The CA/Browser Forum has voted to cut the maximum lifetime of public certificates in stages: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. Manual renewals are on their way out, and failed automatic ones will matter more.
Lapse reads the certificate each site actually serves and only alerts when expiry is 14 days away or closer, so on-schedule auto-renewals stay quiet.