Domain expiration & SSL certificate checker
When does your SSL certificate expire, and when does your domain? Enter a domain and this free checker reads the SSL certificate your server sends and the registration date from the registry, then shows the days left on each, the issuer and when to renew.
Get an alert before it expires.
Uptime Monitoring checks your certificate and domain on a schedule and alerts you before either runs out. Ask Theo, the AI assistant in the app, to explain any finding.
Certificates are getting shorter
The CA/Browser Forum sets how long a public certificate may be valid. Section 6.3.2 of its Baseline Requirements (version 2.3.1) cuts the limit in three steps. Each step counts from the day a certificate is issued, so a certificate issued the day before keeps its longer life. Shorter lives mean more renewals, and less time to notice one that fails.
| Issued | Longest it may be valid |
|---|---|
| Before Mar 15, 2026 | 398 days |
| Mar 15, 2026 to Mar 15, 2027 | 200 days |
| Mar 15, 2027 to Mar 15, 2029 | 100 days |
| From Mar 15, 2029 | 47 days |
What it checks
- Reads the certificate your server sends on port 443: when it expires, the issuer and the names it covers
- Runs a real TLS handshake to check that browsers trust the chain and that it carries your domain name
- Reads your domain's expiry date and registrar from the registry over RDAP, or over WHOIS where the registry has no RDAP
- Flags a certificate with 14 days or fewer left and a domain with 30 or fewer, the same lines Site Health Monitoring uses. A short-lived certificate, valid for under 42 days, is flagged once a third of its lifetime is left
What it does not
- For a site behind Cloudflare it cannot read the certificate directly, since this tool runs on Cloudflare too. It lists the current certificates from Certificate Transparency logs instead, but cannot tell which one a visitor gets or whether browsers trust it
- It reads the certificate over TLS 1.2. A server that speaks only TLS 1.3 sends it encrypted, so I report that instead of a date
- Some registries publish no expiry date over RDAP or WHOIS (.de, .eu, .at, .be), and some refuse automated WHOIS lookups (.ch, .es). For those I cannot see the domain expiry date
- It checks one address for one name. A site behind several servers can serve a different certificate on each
Questions
How do I check when my SSL certificate expires?
Enter your domain above. I read the certificate your server sends and show its expiry date, the days left and the issuer. In a browser, click the icon left of the address bar and open the certificate details.
What happens when an SSL certificate expires?
Browsers show a full-page warning instead of your site, and most visitors leave. APIs and apps that call your site start failing. Nothing on the server changes, so the site looks fine to you until you try it in a browser.
When should I renew my SSL certificate?
Let's Encrypt recommends renewing automatically once a third of the certificate's lifetime is left, which is 30 days for a 90-day certificate. A certificate with 14 days or fewer left usually means automatic renewal failed.
How do I check when a domain expires?
Enter the domain above. I ask the registry over RDAP, the replacement for WHOIS, or over WHOIS where it has no RDAP service, and show the expiry date and the registrar. Renew with your registrar and turn on automatic renewal: a lapsed domain takes the whole site down, email included.
More free tools
Fair use, and how to recognize us
5 per minute · 25 per hour · 100 per day per IP (per /64 for IPv6), plus a per-site limit
Every request these tools make sends this user agent, including the ones that load a page in a real browser. What a run records is set out in our privacy policy.
Mozilla/5.0 (compatible; VitalSentinel Free Tools Bot/1.0; +https://www.vitalsentinel.com/bot)
Stop checking by hand
Core Web Vitals from real users, indexing and robots.txt, uptime and SSL, monitored continuously. Start on the Free plan and add your first domain in under a minute.