How to Check an SSL Certificate Expiry Date Online (2026 Guide)
You have three practical ways to see when a certificate expires: look in the browser, paste the host into an online decoder, or run one OpenSSL command. Each answers the same question with a different amount of detail.
Can I check in the browser without any tool?
Yes. Click the padlock next to the URL, open the certificate details, and read the "Not valid after" / "Valid to" date. Chrome and Firefox both show it, though the path moved around in recent versions — in Chrome it is Connection → Certificate details.
What is the fastest way for a quick check?
An online SSL decoder: paste the domain, and it returns the issuer, the valid-from and valid-to dates, the signature algorithm, and whether the chain is complete. This is the route to use when you manage several domains and want the same fields across all of them.
Can I check with OpenSSL?
Yes, and it works for any host including mail servers and APIs that browsers won't show cleanly:
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subjectHow many days before expiry should I renew?
Renew at 30 days out, and set an alert at 14 days as the hard floor. Browsers warn at 14 days and actively block some browsers past that. Let's Encrypt certificates renew at 60–90 day intervals, so an automated renewal matters more than remembering a calendar date.
What do the certificate fields actually mean?notBefore is when the certificate became valid, notAfter is its expiry. The issuer is who signed it; the subject is the domain it covers. A mismatch between subject and the domain you visited — or a missing intermediate in the chain — is usually the real cause of an "expired" style error even when the dates look fine.
What if the certificate says expired but the site still loads?
Check whether you are on a CDN or proxy that terminates TLS in front of the origin. The edge certificate can be valid while the origin certificate is dead, or vice versa. Test both: the public hostname and the origin IP with a Host header.
For a quick paste-and-check on any domain, SSL Certificate Decoder (https://sslcertificatedecoder.com) shows issuer, validity dates, and chain status in one view.
