How to Check When an SSL Certificate Expires

Updated August 2026 · about a 7-minute read

An expired TLS certificate is one of the few problems that takes a site fully offline for every visitor at once — browsers replace your page with a red full-screen warning. It's also completely preventable. Here are four ways to check when a certificate expires, from the quickest manual look to hands-off monitoring.

1. Check in your browser (10 seconds)

In Chrome or Edge, click the icon to the left of the address bar, choose Connection is secure, then Certificate is valid. In Safari, click the padlock and choose Show Certificate. Look at the Valid from / Valid to (or Expires) dates. Fine for a one-off spot check; useless for staying ahead of dozens of domains.

2. Check from the command line with openssl

The sysadmin's go-to. This prints the issue and expiry dates for any host:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

To ask a yes/no question — "does this expire within 30 days?" — use -checkend, which returns a non-zero exit code if it will:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -checkend 2592000

2592000 is 30 days in seconds. This is the building block people drop into a cron job — which works until the server running the cron has its own problem and the alert silently stops.

3. Use a free online SSL checker

Online checkers (Qualys SSL Labs, and our own free checker) don't just show the expiry date — they grade the whole handshake: chain trust, hostname match, protocol version, and more. Good for a thorough one-off review of a single site.

4. Monitor expiry automatically (so it never catches you out)

Every method above shares the same flaw: it only tells you the moment you remember to look. Real certificates lapse because the person who knew about them left, the renewal cron broke, or the domain simply fell off everyone's radar. The fix is monitoring: a service checks your certificates every day and emails you well before expiry — typically at 30, 14 and 7 days out — and the instant the chain or hostname breaks.

Rule of thumb: if a lapsed certificate on any of your domains would be a bad day, that domain should be monitored, not manually checked.

This is exactly what Perimeter does, alongside security-header and DNS checks. For teams under compliance, expiry monitoring also doubles as SOC 2 evidence.