How to Check an SSL Certificate Expiration Date with SSL Certificate Decoder
Check an SSL Certificate Expiration Date Online
SSL Certificate Decoder lets you inspect the validity dates inside a public SSL/TLS, PEM, or X.509 certificate directly in your browser. It reads the certificate you provide and presents its status, validity period, and days remaining. It does not connect to a domain or replace the input with a remotely fetched certificate, so use the public certificate from the deployment path you want to inspect.
How to Check the Expiration Date
- Obtain the public certificate as PEM text or a PEM-based .pem, .crt, or .cer file. Do not use a private key, PFX, P12, or binary DER file.
- On the SSL Certificate Decoder home page, paste the complete certificate block into the Paste a PEM certificate field, including the BEGIN CERTIFICATE and END CERTIFICATE lines. You can also choose Upload .pem, .crt or .cer.
- Click Decode. The certificate is parsed locally in the browser and the results section opens.
- In the status summary, review Certificate status, Valid from, Valid until, and Days remaining.
- Open the Details tab and expand Validity Period when you need the raw Not Before and Not After fields.
Understand the Validity Dates
Not Before
Not Before is the start of the certificate validity window. Before this time, the certificate is not yet valid. The decoder labels a certificate Not yet valid when the current browser time is earlier than its Not Before date.
Not After
Not After is the end of the certificate validity window. It is the expiration date to use for renewal and deployment checks. The decoder also presents this value as Valid until in the status summary.
Days Remaining
Days remaining is calculated from the current time and the certificate Not After date. It is a fast way to see how close the provided certificate is to expiry, but it only describes the certificate you pasted or uploaded.
Read the Status Result
- Valid: the certificate is already valid and has more than 30 days remaining.
- Expiring soon: the certificate is already valid and has 30 days or fewer remaining.
- Expired: the Not After date has passed, so the remaining-days value is negative.
- Not yet valid: the Not Before date is in the future.
An expired certificate can still show the expected issuer, subject, and domain names, but normal HTTPS clients will reject it because its validity window has ended. A not-yet-valid result can point to a future start date, a scheduled deployment, or an incorrect system clock.
Example: Confirm a Renewal Artifact
When a certificate is renewed, decode the previous public certificate and the replacement public certificate one at a time. Compare the Not After date, serial number, and SHA-256 fingerprint. A newer Not After date can indicate renewal, while a changed serial number or fingerprint shows that the certificate bytes are different. Also review the Subject Alternative Names to confirm that the replacement still covers the intended hostnames.
Common Questions
Can this tool check the certificate currently served by a website?
The page decodes the certificate you provide. Obtain the public certificate from the server, certificate authority, or deployment artifact first, then paste or upload that copy.
Which files can I upload?
The upload control accepts .pem, .crt, and .cer files when they contain PEM certificate data. A file extension alone does not convert binary DER data into PEM text.
Is it safe to paste a certificate?
The tool processes public certificate input locally in the browser and does not upload or store it for decoding. Never paste a private key or a bundle containing a private key.
Where are the exact Not Before and Not After values?
Use the Details tab, then open Validity Period. The summary cards show the same dates as Valid from and Valid until alongside the status and days remaining.
