Every SSL certificate has an expiry date, and the moment it passes, browsers block the site. Here are five ways to find that date, from a one-click check to a script that checks a whole list of sites.
1. Online, in one step
Enter the address in our free SSL checker. It shows the exact expiry date and time, how many days are left, and checks the rest of the setup at the same time: the issuer, whether the chain is complete, whether the certificate covers the hostname, whether it has been revoked and which TLS versions the server accepts.
It works for any public host and port, including non-web services such as mail.example.com:465.
2. In your browser
- Chrome and Edge: click the icon left of the address (the "tune" icon or padlock), choose Connection is secure, then Certificate is valid. The Validity period shows Expires on.
- Firefox: click the padlock, then Connection secure → More information → View Certificate. Look for Validity → Not After.
- Safari (Mac): click the padlock, then Show Certificate, and open Details. The date is under Not Valid After.
The browser shows the certificate it received, which can differ from what other visitors get if you use a CDN or several servers.
3. With openssl (Mac, Linux, WSL)
This connects to the server and prints the expiry date (replace example.com):
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -enddate
The output looks like notAfter=Jan 14 23:59:59 2027 GMT.
To check whether a certificate expires within the next 30 days (2,592,000 seconds), use -checkend. It prints a message and exits with status 1 if the certificate will expire:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -checkend 2592000
For a certificate file on disk, skip the connection:
openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -enddate
Always pass
-servername. Servers that host several sites pick the certificate by name; without it you may be shown a different site's certificate.
4. With curl
curl's verbose output includes the certificate details, including the expiry date, in most builds:
curl -svI https://example.com 2>&1 | grep -i "expire date"
If the line is missing, your curl build doesn't print certificate details; use the openssl command instead.
5. In PowerShell (Windows)
Connect to a site and read the expiry date of the certificate it presents:
$request = [Net.HttpWebRequest]::Create("https://example.com")
$request.GetResponse().Dispose()
$request.ServicePoint.Certificate.GetExpirationDateString()
To list the certificates installed on a Windows server and when they expire:
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter | Sort-Object NotAfter
Check a list of sites at once
Save your hosts one per line in hosts.txt (add :port if it isn't 443), then run:
while read -r target; do
host=${target%%:*}; port=${target##*:}; [ "$port" = "$target" ] && port=443
end=$(echo | openssl s_client -connect "$host:$port" -servername "$host" 2>/dev/null \
| openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
echo "$target ${end:-could not connect}"
done < hosts.txt
Don't rely on checking by hand
Each method above tells you the date today. Certificates now last 200 days at most, falling to 47 days by 2029 (see Preparing for 47-day certificates), so dates change often and renewals can fail silently.
CertHalo checks your certificates on a schedule and emails you 60, 30, 14, 7, 3 and 1 day before they expire, and whenever one changes or is revoked. Monitor 3 certificates free.