How do I check when an SSL certificate expires?

Enter the website hostname and run the check. Read “Valid until” for the expiry date and “Validity” for the remaining days. This is a point-in-time check, not an automatic renewal reminder or certificate monitoring service.

Does this SSL checker perform a full security audit?

No. It inspects one certificate and one TLS connection on port 443. It does not perform a vulnerability scan, revocation check, full certificate-chain report or exhaustive cipher test. A passing certificate check does not establish that an application is secure.

Why can my browser show a different SSL result?

A CDN can serve different certificates at different locations, and browser trust stores can differ from our server’s. Compare the exact hostname, check time and certificate fingerprint. A cached result can also briefly reflect the certificate served before a renewal.

Is this tool free and do I need an account?

It is free to use without an account. Domain checks have request limits to protect public services. Results can be downloaded from this page.

Where is my input processed?

Checks run on our server and contact public DNS, registry, website or Ahrefs services as needed. Results can be cached; inputs are not added to your URL or account. Do not submit private addresses or secrets.

SSL certificate checker

Check an SSL certificate for expiry, hostname match, trust and issuer. Inspect the negotiated TLS version for a public HTTPS domain for free.

A report you can act on

Enter your domains to see measured values, sources and check times. Missing records, unsupported services and temporary failures are shown separately.

From input to output

How to use it

Check an SSL certificate’s expiry, trust and hostname match for a public HTTPS website. This free checker inspects the certificate returned on port 443 and reports its issuer, validity dates, subject alternative names and negotiated TLS version. No account is required.

Enter the exact hostname you want to check.
Run a TLS handshake on port 443, using the hostname for SNI.
Check trust and expiry separately, then review the connection details.

What this SSL certificate check inspects

Enter the exact hostname your visitors use, such as www.example.com. The check connects from our server using that hostname for Server Name Indication (SNI), then inspects the certificate presented by the endpoint.

The report separates certificate trust, hostname match and validity. It also shows the issuer, covered names, negotiated cipher and SHA-256 fingerprint. A successful reading can be reused for up to five minutes; check the timestamp when reviewing a recent renewal.

Understand expiry, mismatch and trust results

A date failure means the certificate is expired, not yet valid or has invalid dates. Fewer than 30 days remaining produces a warning. Compare the exact valid-from and valid-until values before scheduling a renewal.

A hostname mismatch means the certificate does not cover the requested name. An untrusted result concerns verification against our server’s trust store. These checks answer different questions: an unexpired certificate can still fail hostname or trust verification.

Measurement and usage limits

This inspects one certificate and one TLS handshake from our server. It is not a full security audit, cipher scan or revocation check. Other CDN locations may present a different certificate.

Frequently asked questions

How do I check when an SSL certificate expires?: Enter the website hostname and run the check. Read “Valid until” for the expiry date and “Validity” for the remaining days. This is a point-in-time check, not an automatic renewal reminder or certificate monitoring service.
Does this SSL checker perform a full security audit?: No. It inspects one certificate and one TLS connection on port 443. It does not perform a vulnerability scan, revocation check, full certificate-chain report or exhaustive cipher test. A passing certificate check does not establish that an application is secure.
Why can my browser show a different SSL result?: A CDN can serve different certificates at different locations, and browser trust stores can differ from our server’s. Compare the exact hostname, check time and certificate fingerprint. A cached result can also briefly reflect the certificate served before a renewal.
Is this tool free and do I need an account?: It is free to use without an account. Domain checks have request limits to protect public services. Results can be downloaded from this page.
Where is my input processed?: Checks run on our server and contact public DNS, registry, website or Ahrefs services as needed. Results can be cached; inputs are not added to your URL or account. Do not submit private addresses or secrets.