How to Check SSL Certificate Expiry and Avoid Outages

An expired certificate is one of the most avoidable outages on the web, and one of the most common. The site itself is fine; the server is up; but every visitor sees a security warning and every API client refuses to connect. It happens to small sites and very large companies alike, usually because a renewal process that "always worked" quietly stopped.

How to check an SSL certificate's expiration date

• In a browser: click the icon to the left of the address, open the connection or certificate details, and look for "Expires on" or "Valid to".
• From the command line:

  echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
    | openssl x509 -noout -enddate

  This prints a line such as notAfter=Jan 14 23:59:59 2027 GMT.
• Online: the SSL Certificate Checker shows the expiry date and days remaining for every address behind the hostname, which a browser can't.

What happens when an SSL certificate expires

Nothing changes on the server, but every client refuses to trust it. Browsers show a full-page warning with NET::ERR_CERT_DATE_INVALID, and sites using HSTS give visitors no way to click past it. API clients, webhooks and mobile apps fail outright. Search engines can still crawl the site, but visitors who arrive from results land on the warning.

Why certificates expire at all

Expiry limits the damage when something goes wrong. If a private key leaks, or a domain changes hands, a short-lived certificate stops being useful soon. Revocation—cancelling a certificate early—has never worked reliably across all clients, so short lifetimes do the job instead.

SSL certificate lifetimes: 200 days now, 47 days by 2029

The rules for publicly trusted certificates are set by the CA/Browser Forum. In 2025 it approved a phased reduction of the maximum lifetime:

Many sites already use 90-day certificates from Let's Encrypt, and some use certificates that last only a few days. The direction is clear: renewing by hand is no longer practical. If someone on your team puts a reminder in a calendar to renew a certificate, that process needs replacing.

Automate renewal with ACME

The ACME protocol lets a server request and renew certificates without human involvement. Tools such as Certbot, acme.sh and Caddy, and the built-in options at most hosting providers and CDNs, use it. A typical setup tries to renew when a third of the certificate's life remains, and retries daily if it fails.

Why automated renewal still fails

Automation removes the reminder problem but brings its own failure modes. The usual culprits:

• DNS or hosting changes. The domain moved to a new server or CDN, and the old server is still trying (and failing) to prove control.
• Validation blocked. A firewall, redirect rule or maintenance page stops the CA from reaching the HTTP validation file, or a DNS API token expired.
• Renewed, but not reloaded. A new certificate was saved to disk, but the web server kept serving the old one from memory because it was never reloaded.
• Renewed on some servers only. Behind a load balancer, one server renewed and the others did not. Visitors see different certificates depending on which server answers.
• CAA records. The domain's CAA records don't list the CA you switched to, so issuance is refused.
• The job silently stopped. A server rebuild dropped the cron job or timer, and nobody noticed because nothing alerts on success.

Monitor what visitors actually see

Checking the certificate file on disk isn't enough—several of the failures above leave a valid file next to a server still presenting an old one. Check the certificate the way a browser does: connect over the network, read the certificate presented, and alert when the remaining lifetime drops below a threshold (for 90-day certificates, about 20 days gives plenty of time to react).

Check every address behind the hostname, not just one. The SSL Certificate Checker tests each IPv4 address separately and warns when they serve different certificates.

If a certificate has already expired

1. Renew it immediately, by running your ACME client manually or through your host's control panel.
2. Reload or restart the web server so it picks up the new certificate.
3. Confirm from outside that the new expiry date is being served on every address.
4. Find out why automatic renewal failed—otherwise it will happen again at the next renewal.