Test SSL Certificate Expiration for Website Security

Your site was fine on Friday and threw a full-page browser warning on Monday. Nine times out of ten, the certificate expired over the weekend and nobody was watching the clock. That is why teams learn to test SSL certificate expiration for website security before it becomes an outage rather than after.

An expired certificate does not degrade gracefully. It hard-fails, and every visitor sees a red interstitial telling them your site is unsafe. The rest of this post covers how to check the expiry date, what actually breaks when a cert lapses, and how to monitor renewals so the weekend surprise never happens.

Why You Test SSL Certificate Expiration for Website Security

A TLS certificate is a signed statement that expires on a fixed date. Modern public certificates last 90 days or less, and the industry is moving shorter, so the renewal window comes around often enough to forget.

When the date passes, browsers stop trusting the connection. Chrome shows NET::ERR_CERT_DATE_INVALID, Firefox blocks the page, and API clients throw handshake errors that take down integrations with no warning banner.

The damage doesn't stop at a scary page. Search crawlers treat an expired cert as a security problem, payment flows refuse to load, and any service calling your API over HTTPS starts failing closed. Understanding what happens when an SSL certificate expires is the reason this check belongs in your routine, not your incident postmortem.

How to Check SSL Certificate Expiration Date in the Browser

The fastest path needs no install. A browser tool reads the live certificate a server presents and shows the expiry date plainly.

Open the SSL Certificate Checker, enter your domain, and run it. The tool connects to the host, reads the certificate the server sends, and reports the "valid until" date along with the issuer and the covered hostnames.

Three fields matter most on the result.

"Not After" is the hard deadline: everything past it fails.

Check "Not Before" too, since a freshly issued cert with a future start date fails just as hard.

Subject Alternative Names show which hostnames the cert actually covers. A cert valid for example.com but not www.example.com breaks half your visitors while looking healthy on a bare-domain test.

Reading the expiry date is the answer to how to check SSL certificate expiration date without touching a terminal. Note the date, count the days remaining, and set a reminder well before it.

Test SSL Certificate Expiration for Website Security From the Command Line

When you want the check scripted or running in CI, OpenSSL reads the same certificate the browser sees.

Pull the expiry date for a single host:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -enddate
# notAfter=Oct 14 23:59:59 2026 GMT

The -servername flag matters. It sends the SNI hostname, so a server hosting several sites returns the right certificate instead of a default one. Drop that flag and you may test the wrong cert entirely.

For a pass/fail gate, -checkend returns a non-zero exit code when the cert expires within a given number of seconds. The snippet below fails if fewer than 14 days remain:

if echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
   | openssl x509 -noout -checkend $((14*24*3600)); then
  echo "OK: more than 14 days left"
else
  echo "WARN: cert expires within 14 days"
  exit 1
fi

Wire that into a scheduled job and a red build becomes your early warning. To monitor SSL expiry before it lapses across a fleet, loop the same command over a hostname list and alert on any non-zero exit.

SSL Expiration Checker for Multiple Domains

One domain is easy to track. Twenty subdomains, each with its own certificate and renewal schedule, is where teams lose track.

A shell loop turns the single-host check into an SSL expiration checker for multiple domains:

for host in example.com www.example.com api.example.com shop.example.com; do
  end=$(echo | openssl s_client -servername "$host" -connect "$host:443" 2>/dev/null \
        | openssl x509 -noout -enddate | cut -d= -f2)
  printf '%-22s %s\n' "$host" "$end"
done

The output gives you one expiry line per host, so a cert about to lapse stands out. A wildcard cert covering *.example.com still deserves a per-subdomain check, because a subdomain served from a different load balancer can present a stale certificate the wildcard never touches.

If a host fails to return a date, that itself is the signal. It usually means a broken chain or a connection the client refused, which is the next thing to run down.

Reading SSL Certificate Chain Validation Errors

An unexpired certificate can still fail if the chain is broken. Browsers need a path from your certificate up to a trusted root, and a missing intermediate snaps that path.

Ask OpenSSL to verify the full chain:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | grep -E "Verify return code"
# Verify return code: 0 (ok)

A 0 (ok) means the chain resolves. Two common SSL certificate chain validation errors show up instead.

Return code 21, "unable to verify the first certificate," almost always means the server is not sending the intermediate certificate. The cert is valid, but clients cannot build the trust path, so the connection fails on stricter clients even while lenient browsers paper over it.

Return code 10, "certificate has expired," confirms the expiry problem this article is about, this time from the verification layer.

While you have the connection open, the HTTP Headers Inspector shows whether the server also sends Strict-Transport-Security, which forces HTTPS and makes a lapsed cert fail even harder. Pair it with the DNS Lookup tool when a cert looks valid but points at a host your DNS no longer serves.

SSL vs TLS Certificates and What You Are Actually Checking

People say "SSL certificate" out of habit, but the protocol has been TLS for years. The certificate itself is neutral; it works with whatever protocol the server negotiates.

The SSL vs TLS certificate difference is mostly naming. SSL is the deprecated predecessor, TLS is the current standard, and a modern "SSL certificate" is really an X.509 certificate used by TLS 1.2 or 1.3. What you test for expiration is the same file either way.

What matters for security is that the certificate is unexpired, covers the right hostnames, and chains to a trusted root. Protocol version is a separate concern you check at the server config level, not on the certificate.

Stop Guessing and Start Monitoring

Test SSL certificate expiration for website security on a schedule, not the morning your users report an outage. Read the "Not After" date, verify the chain resolves, and confirm every subdomain presents a current certificate. A cert that expires quietly at 2 a.m. is entirely preventable with a check that runs before it does.

The fastest way to look right now is the free SSL Certificate Checker. Enter your domain, read the expiry date and issuer, and confirm the covered hostnames in seconds. Choosing the best free SSL certificate checker tool comes down to one thing: does it show you the "Not After" date before that date shows you an outage. No account, no signup, just the answer.