SSL expiry check
See exactly when your SSL certificate expires — the date, days remaining, and who issued it — read live off your server. Catches expired, self-signed, and wrong-domain certificates too.
Certificates don't break. They expire.
An expired certificate is the most preventable outage on the internet — the expiry date is printed inside the certificate from day one.
It still takes sites down constantly, because renewal is automated once, trusted forever, and never watched. The DNS record moves, the token expires, the cron job dies quietly — and months later the certificate runs out on a weekend.
The fix isn't checking manually more often. It's having something check for you, every day, and email you while there's still time to act — which is exactly what Tell Me When Down does for every site it watches.
Never learn about an expired certificate from a customer.
Tell Me When Down checks your certificate daily and emails you well before it expires — plus uptime, security headers, DNS, and more. Free for your first site.
SSL expiry, answered
How do I check when my SSL certificate expires?
Type your domain into the checker above — it reads the live certificate straight off your server and shows the expiry date, days remaining, and who issued it.
Manually, you can click the padlock in your browser's address bar and open the certificate details, or run: openssl s_client -connect yourdomain.com:443 | openssl x509 -noout -dates.
What happens when an SSL certificate expires?
The site keeps running, but nobody can get to it.
Every browser shows a full-page "your connection is not private" warning instead of your site, and most visitors leave rather than click through.
APIs and webhooks that call you start failing too, since clients reject the expired certificate. Traffic drops to near zero until it's renewed.
How long do SSL certificates last?
Let's Encrypt certificates last 90 days and are designed to renew automatically.
Paid certificates currently last up to 398 days, and the industry is shortening that in steps — down to 47 days by 2029 — precisely because long-lived certificates get forgotten.
The shorter they get, the more renewal has to be automated and monitored.
My certificate renews automatically — why check it?
Because auto-renewal fails silently.
A moved DNS record, an expired API token, a changed webroot, a forgotten CAA record, a paused billing account — any of these stops renewal, and nothing tells you until the old certificate runs out weeks later.
The classic outage isn't "we forgot to renew", it's "renewal broke in March and expired in June".
How do I renew an expired SSL certificate?
On a managed host (Vercel, Netlify, Cloudflare, Render) certificates are provisioned for you — re-check the domain in the dashboard and fix any DNS issue it reports.
On your own server with Let's Encrypt, run certbot renew (or certbot certonly for a fresh one) and reload your web server.
For paid certificates, generate a new CSR and re-issue through your certificate authority.
Does this check www and my apex domain separately?
Check whichever exact hostname your visitors use — certificates cover only the names listed in them.
Most certificates include both yourdomain.com and www.yourdomain.com (or a *.yourdomain.com wildcard), but not all do, and a name that isn't covered shows browser warnings even while the "main" certificate is perfectly valid.
If you serve both, check both.
Related reading
Other free checks
one TLS handshake to your server · reads the public certificate only · nothing stored