How to Check SSL Certificate Expiration (and Why It Matters More in 2026)

When an SSL certificate expires, your website doesn't go down. It does something worse: it stays up behind a full-page browser warning that says "Your connection is not private". Most visitors see that and leave. Checkout pages stop taking payments, forms stop submitting, and integrations that call your site start failing.

Certificate expiry used to be a once-a-year chore. That has changed. Since March 2026, public certificates last a maximum of 200 days, and that limit keeps shrinking until 2029. Let's Encrypt, which issues certificates for a huge share of the web, is cutting its lifetimes too, and it has stopped sending expiry reminder emails.

This guide shows how to check when a certificate expires, five different ways, why "auto-renew" still fails, and how to make sure an expired certificate never takes your site offline.

Why certificate expiry matters more than it used to#

The CA/Browser Forum, the group of browser makers and certificate authorities that sets the rules for public certificates, voted to shrink certificate lifetimes in stages:

The period for which a certificate authority can reuse your domain validation is shrinking on the same schedule, down to just 10 days by 2029. In practice, that means renewing (and proving you control the domain) far more often.

Let's Encrypt is moving the same way. Its default certificates are 90 days today. From February 10, 2027 they drop to 64 days, and from February 16, 2028 to 45 days. And since June 4, 2025, Let's Encrypt no longer sends expiry warning emails at all.

Put together: more renewals, more chances for one to fail, and no automatic email telling you it did. If you rely on remembering, or on a warning email, you need a new plan.

5 ways to check when an SSL certificate expires#

1. In your browser#

In Chrome, click the icon to the left of the address bar, choose Connection is secure, then Certificate is valid. The certificate viewer shows Issued on and Expires on dates, plus who issued it. Firefox, Safari and Edge have the same information behind the padlock.

This is fine for one site. It's slow for many, and it only shows the certificate for the exact hostname you visited.

2. With a free SSL checker#

MyKavo's free SSL Certificate Checker shows the expiry date and days remaining, the issuer, the hostnames the certificate covers, and whether the certificate chain is complete. It's the quickest way to check a site you don't control, or to confirm a renewal actually went live.

3. From the command line#

On macOS or Linux, this prints the start and end dates of the certificate a server is actually serving:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

The notAfter line is the expiry date. The -servername flag matters: many servers host several sites, and without it you may see the wrong certificate.

4. Check every hostname, not just the main one#

example.com, www.example.com, shop.example.com, api.example.com and your mail server can all use different certificates with different expiry dates. The main site renewing tells you nothing about the others. List every hostname you rely on and check each one.

5. Find certificates you forgot about#

Every public certificate is recorded in Certificate Transparency logs. Searching your domain on a CT log search site such as crt.sh lists every certificate issued for it, including subdomains someone set up years ago and forgot. It's a good way to build your list for step 4.

Why "auto-renew" still fails#

Most certificates renew automatically now, through your host, your CDN or an ACME client like Certbot. Automation is the right answer, but it fails more often than people think, and it fails silently.

• The renewal challenge can't reach your server. ACME clients prove you control the domain, often by serving a file over HTTP. A new redirect rule, firewall, CDN setting or maintenance page can block that request, and the renewal quietly fails.
• DNS moved. After switching DNS provider or host, the old server keeps trying to renew a domain that no longer points at it.
• CAA records block your certificate authority. A CAA record that only allows one CA stops a different CA from issuing.
• The certificate renewed, but the server still serves the old one. The web server or load balancer was never reloaded, or the CDN still has the previous certificate uploaded.
• A paid certificate's payment failed. The card on file expired before the certificate did.
• The intermediate chain is incomplete. The certificate is valid, but some browsers and devices reject it because the chain wasn't installed properly.

Each of these looks fine from your desk until the day the old certificate runs out.

What happens when a certificate expires#

• Browsers block the page with a full-screen warning (in Chrome, the error code is NET::ERR_CERT_DATE_INVALID). Most visitors won't click through, and they shouldn't.
• Payments and logins break, because browsers and payment providers won't send sensitive data over an untrusted connection.
• APIs, webhooks and apps fail, often with vague connection errors that take time to trace back to the certificate.
• Trust takes a hit. A security warning on your brand's site is the kind of thing customers remember.

The fix itself is usually quick: renew and install the certificate. The damage comes from the hours or days before anyone notices.

How to never miss an expiry again#

1. Automate renewal everywhere you can. Use your host's or CDN's managed certificates, or an ACME client. With lifetimes heading to 47 days, manual renewal stops being realistic.
2. Keep a list of every hostname that serves HTTPS, including subdomains, APIs and staging sites people actually use.
3. Monitor expiry independently of renewal. Renewal tools can fail without telling you. A separate check that looks at the certificate your server is actually serving catches failed renewals, unreloaded servers and stale CDN certificates.
4. Get reminders well before the deadline, not on the day. Several days of warning is enough time to fix a broken renewal calmly.

MyKavo checks the SSL certificate on every website you monitor, on every plan including Free. It alerts you 14 days before the certificate expires, then reminds you again at 7, 3 and 1 days, alongside uptime checks every five minutes and weekly domain-expiry checks. It's on by default, with nothing to set up.

The bottom line#

Certificates now expire more often than ever, renewals fail silently, and the reminder emails many people relied on are gone. Check every hostname you depend on, automate renewal, and monitor the certificate your server actually serves.

Check your site now with the free SSL Certificate Checker, then start free with MyKavo to get expiry reminders for every site you manage.