How to Check an SSL Certificate Expiration Date (Browser, OpenSSL, and Online)

Read the date in your browser (fastest spot check)

For a page you can already load, the browser tells you everything. In Chrome or Edge, click the tune or site-info icon to the left of the address bar, choose "Connection is secure," then "Certificate is valid." The certificate viewer shows a Validity Period with a "Not Before" and "Not After" date — "Not After" is your expiration. Firefox is the same path under the padlock, then "More information" and "View Certificate."

This is perfect for a quick human check, but it has two limits: it only works for pages that already load in your browser, and it shows you the leaf (server) certificate, not the intermediates behind it. For anything you want to script, automate, or check on a host that isn't serving a normal web page, reach for OpenSSL.

The reliable way: OpenSSL

OpenSSL ships on virtually every Linux and macOS machine and is available for Windows. To pull the dates from a live host, connect and pipe the certificate into the x509 parser:

• Remote host: openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
• That prints notBefore and notAfter — notAfter is the expiration, in GMT.
• The -servername flag sends SNI. Skip it on a host with multiple certificates and you may get the wrong (default) certificate back.
• Local .pem file: openssl x509 -in cert.pem -noout -enddate
• Scriptable check: openssl x509 -checkend 604800 -noout -in cert.pem exits non-zero if the cert expires within 7 days (604800 seconds) — ideal for a cron guard.

Check the whole chain, not just the leaf

A site can serve a perfectly valid leaf certificate and still break, because an intermediate certificate above it expired or was left out of the bundle. Clients build a chain from your server's certificate up to a trusted root, and any expired or missing link fails the whole handshake. This is the single most common "but my certificate isn't expired!" support ticket.

To see every certificate the server actually sends, add -showcerts: openssl s_client -connect example.com:443 -servername example.com -showcerts. Each block is one certificate in the chain — parse each with openssl x509 -noout -subject -dates to confirm none of them is close to expiry. The diagram below shows why one weak link sinks the handshake.

Online checkers when you're not at a terminal

When you just want an answer in a browser tab — including the full chain, the issuer, and days remaining without typing a command — a hosted checker is the quickest path. Our free SSL checker resolves the host, validates the chain, and shows the exact expiry date and how many days are left, which is handy for sharing a clean result with a client or a teammate who doesn't live in a shell.

If a check comes back already expired or untrusted, the fix depends on what broke — a lapsed renewal, a bad chain, or a hostname mismatch. Our walkthrough on what to do when an SSL certificate has expired covers the recovery steps for each case.

Stop checking by hand

Manual checks catch the certificate you remembered to look at. The ones that take you down are the wildcard on a staging box, the mail server, or the client domain you inherited and forgot about. Certificates fail at 2 a.m. on a Saturday, and a 90-day Let's Encrypt cert that stopped auto-renewing gives no warning of its own.

This is exactly what VigilDog's monitoring is built for: it watches expiry across every domain and host you point it at, validates the full chain rather than just the leaf, and warns you weeks ahead — with white-label reports if you're managing certs for clients. If you're weighing where certificate checks fit alongside your existing tooling, see SSL monitoring vs uptime monitoring.