IT infrastructure calculators

SSL Certificate Expiry Checker

Check the TLS certificate currently served for a public hostname on port 443. See issuer, validity dates, days remaining and any trust or hostname problem. CDN edges can differ; revocation is not checked.

Result

Enter a public domain and click Check certificate.

Note: Checks the certificate currently presented on TCP port 443 using SNI. Bad certificates are still shown so you can inspect them; trust is checked against public root CAs and the name against the domain you entered, and any problem is listed above the result. Revocation (OCSP/CRL) is not checked. Results are live and may differ across CDN edges.

Learn more

How it works

Our server connects to the domain on port 443, sends the host name (SNI) and reads the certificate the site presents.

  • It shows the subject, issuer, valid-from and expiry dates in UTC, and the whole days left until expiry.
  • It checks the chain against public root CAs and the name against the domain you entered. An expired certificate, an untrusted chain or a name mismatch is listed above the result.
  • A bad certificate is still shown, so you can see what the site is serving.

Only the host name is used. Any path or port you type is ignored.

Worked example

Say a site's certificate expires 2026-09-29 23:59 UTC and you check it at 2026-09-24 12:00 UTC:

  • Days remaining: 5, because only whole days are counted (checked later in the day than the expiry time, the same certificate would show 4)
  • No problems listed: the chain is trusted and the name matches

If the site uses automatic renewal, a certificate this close to expiry usually means renewal has failed and needs a look now.

Why does my browser show a different certificate?

A CDN can serve different certificates from different locations, and this tool checks only port 443 of the host name. Results can differ from what one browser sees.

Does it check revocation?

No. OCSP and CRL status are not checked, so a revoked certificate can still show as trusted here.

Can I check an internal server?

No. Only public addresses are checked. Private and internal addresses are refused.

What does "Hostname mismatch" mean?

The certificate does not list the domain you entered. Browsers will show a warning for that name even if the certificate is valid for other names.

Maintained by the RACKCRUNCH team. Last reviewed September 29, 2026. How we calculate | Report a problem