How to check when an SSL certificate expires

Every SSL (TLS) certificate has a "not after" date, after which browsers stop trusting it. The fastest way to see it for any public website is an online checker: enter the domain in our free SSL checker and it connects to the site, reads the certificate and shows the expiry date and days left, the issuer, the full chain and whether browsers will trust it.

An online checker reads the certificate your visitors actually receive, which matters more than the file on your server: if a renewal has not been loaded, or a CDN or load balancer serves its own copy, only an outside check will show it. The methods below cover browsers, the command line and Windows servers.

Browser menus change between versions, but the route is similar in each:

• Chrome and Edge: click the icon to the left of the web address, choose the "Connection is secure" option, then "Certificate is valid". The certificate viewer shows the validity period, including the expiry date.
• Firefox: click the padlock, then "Connection secure", "More information" and "View Certificate". The expiry date appears as "Not After".
• Safari on a Mac: click the padlock in the address bar, then "Show Certificate". The summary shows when the certificate expires, and the details list "Not Valid After".

The browser shows the certificate for the page you are on, so it is ideal for a quick look but no help across dozens of domains.

The openssl command is installed on almost every Linux server and on macOS. To read the certificate a live website serves:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

The output is a single line such as notAfter=Jan 14 23:59:59 2027 GMT. Use -dates instead of -enddate to see the start date as well. The -servername option matters: servers that host several sites use it to choose which certificate to send.

To check a certificate file on the server itself, for example one issued by Certbot:

openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -enddate

To ask whether a certificate expires within the next 30 days (2,592,000 seconds), which is handy in scripts:

openssl x509 -in cert.pem -noout -checkend 2592000

It prints "Certificate will expire" or "Certificate will not expire", and the exit code is 1 when it will expire.

To print the days left for a live site on Linux:

end=$(echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
echo $(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 )) days left

On a Mac, date works differently, so use the first command and read the date.

If you use Certbot, sudo certbot certificates lists every certificate it manages with its expiry date and the number of days it remains valid.

PowerShell

Certificates installed on a Windows server live in the certificate store. To list the machine's personal certificates with their expiry dates:

Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object Subject, NotAfter

To show only the ones that expire in the next 30 days:

Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) } | Select-Object Subject, NotAfter

To read the certificate a live website serves from PowerShell:

$tcp = New-Object Net.Sockets.TcpClient("example.com", 443)
$ssl = New-Object Net.Security.SslStream($tcp.GetStream(), $false, { $true })
$ssl.AuthenticateAsClient("example.com")
$ssl.RemoteCertificate.GetExpirationDateString()
$tcp.Close()

certutil

The built-in certutil tool lists certificates in a store, each with a NotAfter line showing when it expires:

certutil -store My

For a certificate file, use certutil -dump certificate.cer.

IIS Manager

In IIS Manager, select the server and open Server Certificates. The Expiration Date column shows when each certificate runs out. Remember that the site bindings decide which certificate each website actually uses.

Checking expiry dates by hand works for one site, once. It does not scale, and certificates now need renewing far more often: since 15 March 2026 the maximum lifespan is 200 days, falling to 100 days in 2027 and 47 days in 2029. See our guide to the SSL certificate expiry changes for the full schedule.

PulseStack™ SSL certificate monitoring reads the certificate each of your sites serves up to once an hour and alerts you when it is within your chosen number of days of expiry (7 by default), or straight away if it stops being trusted. SSL monitors are included from the Starter plan at £9 a month. If a certificate has already lapsed, our guide to an expired SSL certificate walks through the fix.

How do I check an SSL certificate's expiry date online?

Enter the domain into a free SSL checker, such as the one at pulsestack.co.uk/free-tools/ssl-checker. It connects to the site, reads the certificate and shows the expiry date, the days left, the issuer and whether the chain is trusted.

How do I check SSL certificate expiry on Linux?

Run: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate. The notAfter value is the expiry date. For a certificate file on disk, run: openssl x509 -in cert.pem -noout -enddate.

How do I check certificate expiry on Windows Server?

In PowerShell, run: Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter. NotAfter is the expiry date. You can also run certutil -store My, or open IIS Manager and look at the Expiration Date column under Server Certificates.

How can I tell which certificates expire in the next 30 days?

On Windows, run: Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) }. On Linux, run: openssl x509 -in cert.pem -noout -checkend 2592000, which reports whether the certificate will expire within 30 days.

How often do SSL certificates need renewing?

Publicly trusted certificates issued since 15 March 2026 last at most 200 days, falling to 100 days from 15 March 2027 and 47 days from 15 March 2029. Many free certificates are issued for 90 days or less and renew automatically well before they expire.