What this tool shows
An expired TLS certificate throws a browser warning that scares users away and can take a service offline. This checker reads the certificate the site actually serves, over a live handshake, and shows the exact expiry date, the days remaining, the issuer, and the certificate chain. It is the reliable way to confirm how long you have before you need to renew.
Why auto-renewing certs still expire
Automation removes most expiries but not all, and the failures are quiet. A renewal can fail because the ACME HTTP or DNS-01 challenge is blocked or a validation record changed; because the new certificate was issued but the web server or load balancer was never reloaded to serve it; or because one node in a cluster still holds the old file. In every case the renewal job may report success while visitors are handed a stale certificate. The only reliable confirmation is reading the certificate the site actually serves, which is exactly what this checker does.
Frequently asked questions
What does the days number mean?
It's the number of days until the certificate the site actually serves expires, read live from the TLS handshake. Under about 30 days is your cue to confirm renewal is working, under 14 is urgent, and zero or negative means it has already expired and browsers will show a security warning. Most certificates (like Let's Encrypt's 90-day certs) auto-renew around 30 days out, so a healthy site's number resets well before it runs down.
How early should I renew?
Renew at least two weeks before expiry to leave room for propagation and any issues. Many certificates, like those from Let's Encrypt, are valid for 90 days and are meant to auto-renew around 30 days out.
Why does this differ from what I see elsewhere?
Some tools read certificate transparency logs, which show certificates that were issued, not the one currently served. This checker reads the live certificate over a real handshake, so it reflects what visitors actually get.
My certificate auto-renews. Do I still need to check?
Yes. Auto-renewal can quietly fail if a validation record breaks or a hook errors out. Confirming the served certificate and its expiry is the only way to be sure the renewal actually took effect.
What happens the instant a certificate expires?
There's no grace period. Browsers immediately show a full-page security warning (NET::ERR_CERT_DATE_INVALID) that most visitors won't click through, and API clients, mobile apps, and webhooks hard-fail the TLS handshake outright. In practice an expired certificate is a full outage, which is why catching it days ahead matters.