SSL Certificate Checker: Which One Expires Next?
Up to 10 sites at once. For each one: when the certificate expires, who issued it, the names it covers, and whether every browser and API client will trust it.
Why Certificates Still Lapse
Renewal works, the reload doesn't. Certbot gets the new certificate, but nginx keeps serving the old one from memory until it's reloaded. Add a deploy hook that reloads the web server.
The name moved. HTTP validation fails once a site sits behind a CDN or a new load balancer. DNS validation keeps working wherever the site is served from.
Nobody gets the email. Expiry warnings go to whoever set the certificate up, often someone who has left. Let's Encrypt stopped sending them altogether in 2025. Watch expiry from outside instead, with an alert at 14 days.
It's the one nobody remembers. The main site renews; the API, the mail server, the old staging site and the customer's vanity domain don't. Check every name, not only the homepage, which is why this checker takes ten.
Lifetimes are shrinking. The longest a certificate may last fell from 398 days to 200 in March 2026, and falls to 100 in March 2027 and 47 in March 2029. Any certificate still bought and installed by hand will need doing eight times a year.
Questions
How do I check when an SSL certificate expires?
Type the site's name into the checker above: it shows the expiry date and the days left for up to 10 names at once. On a server, echo | openssl s_client -connect example.co.uk:443 -servername example.co.uk 2>/dev/null | openssl x509 -noout -enddate prints the same date.
Why do certificates expire so often now?
Let's Encrypt certificates last 90 days, and the browser makers have agreed to cut the longest any certificate may last, in steps, from 398 days down to 47 days by 2029. Renewal has to be automatic; a calendar reminder once a year no longer works.
What does "missing intermediate certificate" mean?
Your server should send its own certificate and the intermediate certificate that links it to a trusted root. Desktop browsers often fill the gap from their cache, so the site looks fine, but phones, API clients, curl and payment providers fail. The fix is to serve the full chain file (fullchain.pem with Let's Encrypt) instead of the certificate alone.
Why does my certificate say it doesn't cover this name?
A certificate lists the names it is valid for. A certificate for example.co.uk doesn't cover www.example.co.uk unless both are listed, and *.example.co.uk covers one level only: www.example.co.uk, but not example.co.uk itself or a.b.example.co.uk.
Is a self-signed certificate OK?
Only for testing or internal tools where you control every client. Browsers show a full-page warning, and people learn to click through warnings, which is worse than the warning itself. Free certificates from Let's Encrypt or ZeroSSL remove any reason to use one on a public site.
My certificate renewed but the site still shows the old one. Why?
The web server reads the certificate when it starts, so it needs a reload after each renewal. Certbot does this with a deploy hook (--deploy-hook "systemctl reload nginx"). Also check every server behind a load balancer, and any CDN or proxy that holds its own copy.
Does this checker store the names I check?
No. It connects to port 443 on each name's public address and reads the certificate. Only a count of checks per visitor is kept for an hour, to stop abuse. Private and internal addresses are never contacted.
Certificates You Have to Remember to Renew?
I move every name onto automatic renewal, add the reload hooks, and watch expiry from outside so nothing lapses again.