How do I check when an SSL certificate expires?
Enter the public hostname above. ExpiryBeacon opens a TLS connection from the server and returns the expiry date and the number of whole days remaining, along with the issuer and trust result.
Expiry answer
SSL expiry checker
One question, answered from a live connection: how long has this certificate got? Enter a public hostname and you get the expiry date, the days remaining, and whether the chain still validates.
Try:
A real TLS connection is made from the server. URLs, IP addresses, localhost, and private ranges are refused before anything is opened.
Reading the expiry answer
The expiry date is the certificate's own notAfter value, shown in UTC. Certificate validity is defined in UTC, and rendering it in a local timezone is a reliable way to be an hour or a day wrong about a deadline that matters.
Days remaining is rounded down. A certificate with 7 days and 22 hours left reads as 7 days, which is the conservative direction for a deadline and matches how renewal tooling usually counts.
If the number is negative, the certificate expired that many days ago and browsers are already refusing the connection. The check still completes and still reports the full certificate, because knowing which expired certificate is still being served is the first thing you need in that situation.
Why the padlock in your browser is not a check
Looking at the certificate in your own browser is the most common way to check expiry, and the least reliable.
- Your browser may complete the chain from a cached intermediate the server never sent, so it shows trusted where a fresh client fails.
- You are checking whichever origin your DNS and network path reached, which may not be the one a customer in another network reaches.
- Session resumption and HTTP caching can show a connection that was established some time ago.
- It tells you nothing about the endpoint on 8443 that nobody has looked at since it was configured.
- It is a manual action, so it happens when you remember rather than when the expiry approaches.
Checking an endpoint that is not on 443
Enter the hostname without a scheme
Just the name — admin.example.com. URLs, paths, and IP addresses are rejected before any connection is attempted.
Pick the port
443, 8443, and 9443 are supported. These cover the standard HTTPS port and the two most common alternate TLS ports on admin and API endpoints.
Compare the fingerprint
If several endpoints are meant to share a certificate, compare the SHA-256 fingerprints. Identical fingerprints confirm the same certificate; different ones mean a renewal only landed in some places.
From a one-off check to a standing one
A manual expiry check is only ever true at the moment you run it. Saving the endpoint as a monitor moves the same handshake onto a daily schedule at 08:00 UTC, keeps the history of what each check found, and lets you set a 30, 14, or 7 day warning window.
Email alerts are opt-in and fire on a change of state rather than on a timetable, so entering the warning window, losing trust, expiring, failing a check, and recovering each produce one message and no repeats.
Scheduled checks and history need an account; the checker on this page does not.
Questions about ssl expiry checker
Why does this show a different expiry date from my browser?
Different origins can answer for the same hostname, and browsers can also show a connection established earlier. The result here includes the resolved IP address so you can tell exactly which origin was checked.
Is the expiry date shown in my timezone?
No, it is shown in UTC. Certificate validity windows are defined in UTC, so that is the form that can be compared with the certificate itself and with most tooling.
Can I be told before it expires instead of checking?
Yes. Save the endpoint as a monitor, sign in with Google for daily scheduled checks, choose a 30, 14, or 7 day warning window, and enable email alerts in the account policy.