About the SSL Certificate & Expiry Monitor
Almost every certificate outage is the same outage: nobody was watching the countdown. This tool opens a real TLS connection to the host you name and reads the certificate the server actually presents — not a cached database record, not a certificate-transparency log entry that may describe a certificate never installed.
From that single handshake it reports the issuer, the exact validity window with a days-to-expiry countdown, every Subject Alternative Name the certificate covers, the negotiated protocol and cipher, and the chain the server sends. Then it runs the failure modes that actually take sites down: hostname not covered, self-signed, missing intermediate (works in Chrome, breaks in curl and mobile), weak SHA-1 signatures, undersized RSA keys, and a chain that will not verify against the public trust store.
Because the check is a handshake rather than a database lookup, it works on any TLS port — mail on 465 or 993, an admin panel on 8443 — and it sees a certificate the moment you install it. Nothing about the hosts you check is stored beyond a ten-minute result cache. Pair it with our HTTP Security Grader for headers and DNS Propagation Checker for the record behind the name.
https:// URL works too. www.example.com and example.com are separate checks.Paste the hostnames you expect this certificate to cover — one per line — and each is graded against the SAN list, wildcards included.
Export renewal reminders at 30, 14 and 7 days before expiry for every host on your watchlist.
How to Use the SSL Certificate Checker
Enter the hostname exactly as clients reach it — TLS certificates are matched against the
name in the request, so example.com and www.example.com are genuinely
separate checks and one can be broken while the other is fine. Leave the port on 443 for a
website, or switch it for a mail or admin service. The check opens a real handshake from our
server, so it reflects what a visitor gets right now, including a certificate you installed
thirty seconds ago.
Read the days-to-expiry hero first, then the findings list. The health grade beside it is not just expiry: it folds in hostname coverage, chain completeness, signature algorithm, key size and protocol support, because a certificate with 300 days left can still be completely broken for half your clients.
Expiry Is the Symptom — Failed Automation Is the Disease
When a certificate expires in production, the certificate is almost never the problem. The
problem is that renewal has been failing quietly for weeks. Certbot and its equivalents attempt
renewal at 30 days remaining and retry twice daily, so a certificate showing 12
days left has already failed roughly 36 renewal attempts. The usual causes are worth knowing by
heart: the HTTP-01 challenge path /.well-known/acme-challenge/ now redirects to HTTPS
or is swallowed by an application router; the DNS-01 credential rotated; a firewall rule started
blocking inbound port 80; or the renewal cron ran in a container that no longer exists. Treat any
reading under 30 days on an automated certificate as an alarm, not a countdown.
Why the Common Name No Longer Counts
Certificates carry two places a hostname can appear: the legacy Common Name in the subject, and the Subject Alternative Name extension. Since Chrome 58 shipped in 2017, browsers ignore the common name entirely and validate against SANs only — a change that quietly broke a generation of internal certificates. That is why this tool lists every SAN and tells you which one matched. Two wildcard rules catch people out constantly:
- A wildcard covers exactly one label.
*.example.commatcheswww.example.combut nota.b.example.com. - A wildcard does not cover the bare domain.
*.example.comdoes not matchexample.com; the apex needs its own SAN, and most CAs include it — but not all do.
The Missing Intermediate: The Bug That Only Some People See
A publicly trusted certificate is signed by an intermediate CA, which is in turn signed by a root
in the client’s trust store. Your server is responsible for sending the leaf
and the intermediate; only the root is expected to be local. When an admin installs just
the leaf, desktop Chrome and Firefox often still work — they cache intermediates from other
sites and can fetch a missing one through the certificate’s Authority Information Access
extension. Almost nothing else does. Java clients, Python requests, curl,
older Android, and payment or webhook callers all fail with an unable-to-get-issuer error. The
symptom is unmistakable: “the site is fine in my browser but the API integration
can’t connect.” The fix is to install the fullchain file your CA supplies rather than
the leaf-only cert.
Reading the Protocol and Cipher Line
The negotiated line shows what our client and your server agreed on, which is the best both support. TLS 1.3 is the modern target: it completes the handshake in one round trip instead of two, and it removed every cipher suite without forward secrecy from the specification, so a TLS 1.3 connection cannot be misconfigured into a weak cipher. TLS 1.2 remains perfectly acceptable and is still required for a long tail of older clients. TLS 1.0 and 1.1 were deprecated by RFC 8996 in 2021 and disabled in every major browser — note that this tool reports only 1.2 and 1.3, because our own OpenSSL build refuses to speak the deprecated versions at all and therefore cannot honestly test whether your server still offers them.
Certificate Lifetimes Are Collapsing — Plan for It
Maximum certificate lifetime has fallen repeatedly: 39 months, then 825 days, then 398 days in September 2020, with the CA/Browser Forum agreeing in 2025 to a phased reduction that ends near 47 days. Each cut narrows the window in which a stolen private key stays useful, and each one makes manual renewal less viable. The practical consequence for anyone running more than a couple of hosts: automate issuance with ACME, and monitor the result independently of the tool that issues it. A renewal system that reports success while serving an old certificate is a real and common failure — which is exactly why an external handshake check is worth running.
What This Tool Does Not Check
It does not query revocation status. OCSP and CRL lookups are separate protocols, and the browser ecosystem has largely moved away from live OCSP toward pushed lists such as Firefox’s CRLite and Chrome’s CRLSets, so a live OCSP result would not reflect what users experience anyway. It also does not evaluate HTTP security headers, HSTS preloading, or mixed content — run the HTTP Security Grader for those. If the hostname itself is not resolving the way you expect, start with the DNS Propagation Checker. Browse all Dev & Tech tools for more.
Frequently Asked Questions
How many days before expiry should I renew an SSL certificate?
ACME clients such as Certbot renew at 30 days remaining by default, and that is the right target. If you ever see fewer than 14 days left on an automated certificate, renewal is already failing silently — check the renewal timer and the HTTP-01 or DNS-01 challenge path rather than waiting.
What is a SAN and why does it matter more than the common name?
A Subject Alternative Name is an entry in the certificate listing a hostname it covers. Browsers have ignored the legacy common name field since Chrome 58 in 2017 and validate against SANs only, so a certificate whose CN says example.com but whose SAN list omits it will fail. A wildcard SAN such as *.example.com covers one label level: it matches www.example.com but not example.com or a.b.example.com.
My site works in Chrome but fails in a mobile app or curl — why?
That is the signature of a missing intermediate certificate. Desktop browsers cache intermediates from previous sites and can fetch them via the Authority Information Access extension, so they paper over the gap. Java, Python, curl, Android and most API clients do not, so they see an incomplete chain and reject it. Install the full chain file your CA provides, not just the leaf.
Does this tool check certificate revocation?
No. It performs a live handshake and validates the presented chain against the system trust store, expiry dates, hostname coverage, signature algorithm and key strength. Revocation status via OCSP or CRL is a separate lookup, and browsers themselves have largely moved to pushed revocation lists such as CRLite rather than live OCSP checks.
Why does a 90-day certificate lifetime keep getting shorter?
The CA/Browser Forum has been steadily cutting maximum lifetimes — 825 days, then 398 days in 2020, with a phased reduction toward 47 days agreed in 2025. Short lifetimes limit the damage window of a compromised key, and they make manual renewal impractical, which is the point: automate with ACME and monitor rather than diary-note a yearly reissue.
