What is an SSL expiry check?
An SSL expiry check reads the validity dates from the certificate a server presents and reports how many days remain before it stops being trusted. Running it across a list of hostnames at once shows which certificates need attention first, without opening each site or logging in to any server.
How to use it
- Paste one hostname per line, or separate them with commas or spaces.
https://prefixes and paths are stripped automatically. - Up to 20 hostnames per run. Duplicates are checked once.
- Each name is checked on port 443 as written, so
example.comandwww.example.comare separate checks — they can serve different certificates. - Results are sorted by urgency. Download them as CSV to keep or share.
How to read the results
| Status | Meaning |
|---|---|
| OK | Valid, trusted, and more than a third of its lifetime still remains. |
| Renewal overdue | Valid, but less than a third of its lifetime is left. Automated renewal should already have replaced it. |
| Critical | Seven days or fewer remain. |
| Expired | Past its end date. Visitors are seeing a browser warning now. |
| Invalid | In date, but the chain is incomplete or the certificate does not match the hostname. |
| Error | No certificate could be read — the host did not answer on port 443, or the name does not resolve. |
The lifetime column is the total validity of the certificate in days. It tells you what kind of renewal process is behind it: about 90 means Let's Encrypt or similar automation; close to 200 or more usually means someone installs it by hand.
Why "renewal overdue" instead of "30 days left"
Most tools warn at a fixed number of days before expiry. That made sense when certificates lasted a year or more. It works badly now. A 90-day certificate renewed on schedule drops under 30 days remaining in every cycle, so a 30-day warning fires for perfectly healthy certificates — and people learn to ignore it.
This tool compares days remaining with the certificate's own lifetime. Automated clients such as Certbot renew when about a third of the lifetime is left. If a certificate has passed that point and is still being served, renewal has probably failed, and that is worth knowing with weeks still on the clock.
| Certificate lifetime | Flagged as overdue below |
|---|---|
| 398 days (issued before March 2026) | 133 days |
| 200 days | 67 days |
| 90 days | 30 days |
| 47 days (maximum from March 2029) | 16 days |
What to do with an overdue or expired certificate
On the server that holds the certificate, try a renewal by hand and read the error. With Certbot:
sudo certbot renew --dry-run
sudo systemctl list-timers | grep certbotThe causes are nearly always one of these:
- The renewal timer or cron job is disabled or was lost in a server rebuild.
- HTTP validation fails because a redirect, firewall rule or proxy now blocks
/.well-known/acme-challenge/. - DNS validation fails because an API token for the DNS provider expired or was revoked.
- A CAA record does not include the certificate authority. Check it with the CAA checker.
- Renewal succeeded but the web server was never reloaded, so it still serves the old file.
What this check does not do
To keep a 20-host run fast, the bulk check reads validity dates, issuer, chain trust and hostname match, and skips the revocation lookup, which can mean downloading a multi-megabyte list per certificate. For the full report on one host — revocation, key strength, the whole chain — use the SSL certificate checker.