SSL / TLS

When does your certificate expire — and what does it cover?

An expired certificate takes a site fully offline behind a full-page browser warning. This tool opens a real TLS connection and reads the certificate your server presents.

We open a TLS connection on port 443 and read the certificate.

We open a real TLS connection to port 443 and read the certificate presented, including the chain. Validation is deliberately not enforced during the read, so that expired or mismatched certificates can still be inspected and reported rather than producing a bare connection error.

The guide behind this tool SSL Certificates: Expiry, Chains and the Errors That Cost You Traffic Why certificates fail, why a site can look fine on your laptop and broken on a customer's phone, and why paying for a certificate is usually pointless. Read the guide · 5 min read →

What this tool checks

A real TLS connection to port 443, reading the certificate your server actually presents.

  • Days until expiry

    An expired certificate does not degrade a site, it takes it fully offline behind a browser warning.

  • Hostname coverage

    Which names the certificate covers, and whether this one is among them.

  • www and apex

    A certificate for example.com does not cover www.example.com unless www is listed. You never notice, because you always type it the same way.

  • Chain completeness

    Whether the intermediate is sent. Desktop browsers hide a missing one; many mobile clients do not.

  • TLS version

    1.3 is current and a round trip faster than 1.2. Anything below 1.2 is rejected by modern browsers.

  • Issuer and algorithm

    Who issued it and how it is signed.

  • Certificate lifetime

    Browsers reject publicly-trusted certificates issued for more than 398 days.

How to read your result

Expiring inside 21 days means renewal has already failed. A Let's Encrypt certificate is designed to renew at day 60 of 90. If it has not, the automation broke — a firewall rule, a moved webroot, an expired API token. Check the renewal job now, not next week.

A hostname the certificate does not cover is a full security warning for every visitor reaching the site that way. This is the failure you never encounter yourself.

A short chain means the intermediate certificate is missing. Your laptop probably fetches it silently and shows a padlock; a customer's Android phone or a payment provider's API client may not, and sees an untrusted certificate. "It works for me" is not a valid test for TLS.

On free versus paid: for encryption they are identical, and browsers stopped displaying the distinction years ago. Pay for a certificate only when a specific compliance requirement names one.

Set an independent alert on the live certificate's expiry date rather than on whether the renewal job reported success. The failure mode you need to catch is the automation stopping quietly.

What actually goes wrong with certificates

Expiry

The most common and most damaging failure. Browsers show a full-page interstitial that most visitors will not click through, and search crawlers treat the site as unreachable. Revenue goes to zero, not down.

Let's Encrypt certificates last 90 days and are designed to be renewed automatically at 60. Automation removes the risk entirely — until the renewal cron silently fails and nobody notices for a month. Monitor the expiry date independently of the renewal process; the failure mode is always "the automation stopped working quietly."

Hostname coverage

A certificate covers specific names, listed in the Subject Alternative Name field. A certificate for example.com does not cover www.example.com unless www is explicitly listed — and vice versa. Half your visitors get a security warning and you never see it because you always type it the same way.

Wildcards (*.example.com) match exactly one label. shop.example.com is covered; eu.shop.example.com is not.

Chain problems

Your certificate is signed by an intermediate certificate, which is signed by a root the browser already trusts. Your server has to send the intermediate. If it does not, most desktop browsers paper over the gap by fetching it themselves — but many mobile browsers, API clients and older systems do not, and they see an untrusted certificate.

This is why a site can work perfectly on your laptop and fail on a customer's phone. Always test the full chain, not just whether your browser shows a padlock.

TLS version

TLS 1.2 is the minimum acceptable. TLS 1.3 is faster — it completes the handshake in one round trip instead of two, which is a measurable speed improvement, not just a security one. TLS 1.0 and 1.1 are deprecated, rejected by modern browsers, and fail PCI compliance.

What a certificate does not tell you

An EV or OV certificate costs more and proves the organisation was verified, but browsers stopped displaying that distinction years ago. For almost every site, a free Let's Encrypt certificate provides identical encryption and identical browser treatment. Pay for a certificate only when a specific compliance requirement names one.

Frequently asked questions

How long before expiry should I renew?

Automation should renew at one third of the lifetime remaining — day 60 of a 90-day Let's Encrypt certificate. Set an independent alert at 14 days that fires if the certificate has not renewed, because the failure you need to catch is the automation stopping silently.

Is a free certificate as good as a paid one?

For encryption, identical. Let's Encrypt uses the same algorithms and gets the same browser treatment. Paid certificates add organisational validation, longer support and sometimes a warranty. Since browsers no longer display validation level differently, most sites gain nothing measurable from paying.

My site works but the checker warns about the chain. Does it matter?

Yes. Desktop browsers often fetch the missing intermediate themselves, which hides the problem. Mobile browsers, API clients and older devices frequently do not, and they see an untrusted certificate. It is a real failure affecting a subset of your visitors that you will never encounter yourself.

Do I need a wildcard certificate?

Only if you have many subdomains or create them dynamically. Otherwise list the specific hostnames — a wildcard is a larger blast radius if the private key is ever compromised, since it covers everything under the domain.

Other free tools

SEO & Speed Audit

Real Core Web Vitals from Google's API, plus live on-page checks against your actual HTML.

Tell us what you are trying to grow.

One team. Three offices. Twenty-six languages. Send us the problem and you get a senior answer — not a sales script.

Get a proposal → Message us now

A written proposal within one business day, in your language.