SSL Certificate Expiry Checker

Use openssl: echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate. Or with curl: curl -vI https://example.com 2>&1 | grep expire. For browser-based simulation, this tool shows certificate status based on domain patterns and includes CLI command references for real checks.

SSL/TLS certificates are time-limited for security reasons — shorter lifetimes reduce the window during which a compromised certificate can be misused. Since September 2020, CA/Browser Forum limits publicly trusted certificates to 398 days (approximately 13 months). Google Chrome has proposed reducing this to 90 days by 2026.

Browsers show a security warning page blocking access to your site ('Your connection is not private'). HTTPS connections fail. Email clients may reject connections to mail servers. APIs using certificate pinning will stop working. SEO rankings can drop as Google treats HTTPS as a ranking signal.

Use Certbot with Let's Encrypt: certbot renew runs automatically as a cron job or systemd timer. Most cloud providers (AWS ACM, Cloudflare, Vercel) auto-renew certificates. For nginx, the certbot nginx plugin handles renewal and configuration updates. Set up monitoring alerts at 30, 14, and 7 days before expiry.

A SAN is an extension in an SSL certificate that allows it to secure multiple domain names. A single certificate might cover example.com, www.example.com, api.example.com, and *.example.com. Modern certificates use SANs instead of the older Common Name (CN) field. Wildcard certificates (*.example.com) cover all immediate subdomains.

The issuer is the Certificate Authority (CA) that signed and vouches for your certificate. Common CAs include Let's Encrypt (free, automated), DigiCert, Sectigo, GlobalSign, and Comodo. Browsers maintain a trust store of recognized CAs. If your issuer is not in the browser's trust store, visitors will see a certificate error.