🩺 How to Check an SSL Certificate's Expiration Date

SSL/TLS certificates aren't valid forever — they're issued with a fixed expiration date, and missing it can trigger scary browser warnings that break visitor trust in an instant. This article explains why certificates are designed to expire, what actually happens when one does, and how to check expiration dates proactively so you never get caught off guard.

Why certificates are designed to expire

Giving a certificate a limited lifespan isn't just bureaucratic policy — it's a deliberate security measure. If a certificate's private key is ever compromised, if domain ownership changes hands, or if the cryptographic algorithms it relies on become weak, a shorter lifespan forces regular re-validation and renewal, limiting how long a stale or compromised certificate can stay in circulation. This lifespan is governed by rules set by the CA/Browser Forum, a body that includes both browser vendors and certificate authorities (CAs), and the maximum allowed lifespan has been trending shorter over time. Since 2020, the maximum validity period for a publicly trusted certificate has been capped at 398 days, and a 2025 CA/Browser Forum vote (Ballot SC-081v3) locked in an even shorter roadmap: certificates issued on or after March 15, 2026 can be valid for at most 200 days, dropping further to 100 days in March 2027 and 47 days in March 2029. The 2-3 year certificates that were once common are already impossible to issue, and renewal cycles are about to get a lot tighter. The goal is to shrink the window during which a certificate could sit around unmonitored and become a security liability.

What happens when a certificate expires

Once a certificate's expiration timestamp passes, browsers stop trusting the site's identity entirely. Major browsers like Chrome and Safari show a full-page warning — "Your connection is not private," "NET::ERR_CERT_DATE_INVALID" — and block access unless a visitor manually clicks through an "Advanced > Proceed anyway" prompt. This isn't a minor inconvenience: it's a serious outage that will drive away most visitors, hurt your standing with search engines, and can even break server-to-server integrations, like another service calling your API over HTTPS. That last case is especially dangerous, because there's no human watching a browser warning — the failure can go unnoticed until something downstream quietly breaks.

Checking expiration proactively

You can click the padlock icon in a browser's address bar to inspect a certificate, but that only works one site at a time, and only if someone remembers to check it manually. A more practical approach is to just enter a domain and instantly see the expiration date, issuing CA, and trust status of whatever certificate the server is currently presenting. Setting a threshold — say, alerting yourself when a certificate is 30 or 7 days from expiring — gives you enough lead time to renew before anything actually breaks.

If you're running production, automate the monitoring

Manual checks are fine if you only manage one certificate, but once you're running multiple domains or subdomains, it's unrealistic to track every expiration date by memory. Even with auto-renewing certificates like Let's Encrypt's 90-day certs, it's worth periodically verifying expiry dates in case the renewal automation itself silently fails. If you want a quick way to check a domain's current HTTPS connectivity and certificate trust status right now, a tool that surfaces the expiration date and trust chain the moment you load it is the fastest way to get an answer.

More guides