SSL Certificate Expiry Checker

Calculate exact certificate expiry dates and renewal timelines

Calculating expiry dates...

Valid From

Valid Until

Total Validity

Issuer

About SSL Expiry Calculator

An SSL certificate expiry checker reads a certificate and reports the exact expiry time, the days remaining, and the historical validity period. This page calculates the same figures from a pasted certificate. Provides detailed timeline visualization for certificate lifecycle management.

How to Use

1Enter your domain name in the input field
2Click "Calculate" to analyze certificate expiry
3Review the expiry timeline and validity details

Use Cases

•Plan certificate renewals before expiry
•Audit certificate timelines for compliance
•Generate compliance reports for certificate status

Frequently Asked Questions

The calculation is highly accurate, reading directly from the certificate's notBefore and notAfter fields. Results are precise to the second based on the certificate's embedded timestamps.

All timestamps are displayed in UTC for consistency. The tool converts certificate dates to your local timezone for display, but the underlying calculations use UTC to avoid timezone issues.

Yes, you can check multiple domains by entering each one separately. For bulk monitoring, consider using the Expiry Watch tool which allows tracking multiple certificates simultaneously.

Days are counted in whole numbers, so anything under a full day rounds down to zero and zero is reported as expired. A certificate that expires in five hours and one that expired five hours ago are indistinguishable by the day count alone. This is deliberate: the figure is a planning aid measured in days, not a real-time clock. When you are inside the final day, read the exact expiry timestamp shown beside it, which is the authoritative value.

Because verification is switched off for the handshake. A normal client checks the chain, the hostname and the dates before it hands back a certificate, and if any of those fail it simply refuses — which means it can only ever report on certificates that were already fine. Turning verification off means an expired, self-signed or mismatched certificate can still be parsed, so the expiry of a broken setup is exactly what you can read here.

Total validity is the distance between the certificate's start and end dates — how long it was issued for, regardless of how long is left. It varies by certificate type and issuer: domain validated certificates are commonly 90 days, organisation and extended validation certificates can run much longer, and the CA/Browser Forum caps subscriber certificates at 398 days. A high number here is worth a second look, because long-lived certificates are what make a missed renewal so expensive.

It tells the tool which port to complete the TLS handshake on. The default of 443 covers the overwhelming majority of sites, but hosts behind a load balancer or a management interface often terminate TLS on something else: 8443, 9443 and 4433 are all common. Use it when you know the certificate is being served on a non-standard port, and remember that a plain HTTP service on that port will fail the handshake rather than return no certificate.

Because X.509 defines both timestamps in UTC, as UTCTime for dates before 2050 and GeneralizedTime after. The certificate authority decides the moment of expiry and expresses it in UTC, and every client that reads it converts to local time for display only. No conversion is applied here, because the value you see is the value that is actually encoded in the certificate and is therefore the one to compare against when debugging with openssl.

How the Expiry Is Calculated

Expiry dates are not stored anywhere the page can read. They are read straight off the certificate the server presents, which is the only copy that matters — the one a visitor actually receives.

1Open a connection to the host on the port you gave, defaulting to 443, with a ten second timeout.
2Complete a TLS handshake with verification deliberately switched off. This is the part that makes the tool useful: a client that validates normally refuses to return a certificate that is expired or self-signed, so it could never report on the certificates that most need checking.
3Take the raw certificate bytes the peer sent and parse them as X.509. No trust decision is involved — only structure.
4Read two timestamps from inside it: the start of validity and the end of validity, both defined by the certificate in UTC.
5Subtract to get days remaining against the current time, and the full span between the two timestamps to get total validity.

Days are counted in whole days, so a certificate with less than a day left reports as 0. Check the exact timestamp rather than the day count when you are inside the final 24 hours.

Tips & Best Practices

•Calculate certificate expiry dates to plan renewal schedules
•Set reminders based on calculated expiry dates for timely renewal
•Use expiry calculations for certificate lifecycle planning
•Factor in processing time when planning certificate renewals

Technical Details

Calculation: Certificate validity period and expiry date computation
Input: Certificate notBefore and notAfter fields
Output: Expiry date, days remaining, and renewal recommendations
Scheduling: Optimal renewal timing suggestions