SSL Certificate Expiry Checker
Check expiry dates for up to ten hosts at once. Free, and checked from our server, so you see what the public internet sees — no sign-up or install.
About Certificate Expiry Checker
Certificate expiry is a scheduled outage that everyone forgets about. This checks up to ten host names in one run, reports the days remaining for each, and warns on anything inside the window you set — 30 days by default, which leaves room for a renewal to fail and be retried.
The results come back as a table — hostname, status, days remaining, the date it runs out and the CA that issued it — sorted by how soon each one expires rather than by the order the hosts were typed. Anything already expired is at the top, anything that would not answer is at the bottom, and the issuer is there because it names who a renewal has to go through.
Keep a list of the hosts you own in a note and paste it in periodically, or before a release. It is a two-second check against a class of incident that reliably takes a site down at the worst moment.
Where it helps
- Ten hosts per run, so a whole estate is checked at once.
- A configurable warning window, from a day up to a year ahead.
- Reports the actual expiry date alongside the day count, so it can go straight into a calendar.
- Checks the certificate as served, catching a renewal that never reached the load balancer.
- A table ordered by urgency, naming the issuing CA, so a list of renewals can be worked down from the top.
Limits
- Ten hosts is a hard limit per run; larger fleets need several runs.
- It is a manual check, not monitoring — it will not wake anyone at 3am.
- All hosts share one port, so a mix of 443 and 8443 endpoints needs separate runs.
- Publicly reachable hosts only; private addresses are rejected.
Frequently asked questions
How much warning should I set?
Thirty days suits an automated renewal, which usually attempts at 30 days and retries. For a manual process where a purchase order is involved, 60 or 90 is more realistic.
Let's Encrypt renews automatically — is this still worth running?
Yes. Automated renewal fails quietly more often than people expect: a broken hook, a changed webroot, or a certificate renewed but never reloaded.
Can I check different ports in one run?
No, one port applies to the whole list. Group hosts by port and run each group separately.
One host fails while the rest succeed. Why?
Each host is checked independently, so a DNS failure, a firewall block or a closed port affects only that row. The reported error says which.
Related tools
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- Certificate Viewer — Decode a PEM certificate or CSR in the browser
- DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
- CSR Generator — Generate a key pair and certificate signing request locally
More SSL & Certificates tools
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- Certificate Viewer — Decode a PEM certificate or CSR in the browser
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
- CSR Generator — Generate a key pair and certificate signing request locally
- Self-Signed Certificate Generator — Create a certificate and key for local HTTPS, or a private CA to sign development certificates
- Certificate Converter — Convert certificates between PEM, DER and Base64, unpack .p7b bundles, and put a chain in order
- Certificate Transparency Search — Every certificate public CAs have issued for a domain, the subdomains they reveal, and what is about to expire