How to Check When an SSL Certificate Expires (3 Easy Ways)

Every SSL certificate has a hard end date, and the moment it passes, browsers block your site with a full-page warning. If you're wondering how to check when an SSL certificate expires, you don't need special software. The date is printed inside the certificate itself, and you can read it in your browser, with one terminal command, or with a free online checker. This guide walks through all three, then shows how to stop checking by hand.

Short answer: click the padlock (or "site information" icon) next to the address bar, open the certificate, and look for Expires On (Chrome, Edge) or Not After (Firefox, Safari). From a terminal, run:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate

It prints one line like notAfter=Jan 9 09:00:18 2027 GMT. That's your expiry date.

If you want the story of why expired certificates cause so much damage, read SSL certificate expiry: the silent outage that costs you sales. This post is the practical side: finding the date, and getting warned before it arrives.

How to check when an SSL certificate expires: 3 ways at a glance

Method	Best for	What you get	Time needed
Browser padlock	A quick look at one site	Exact expiry date and time, issuer	10 seconds
openssl command	Developers, servers, scripts	Exact notAfter date, a pass/fail "expires within N days" test, the full chain	30 seconds
Online SSL expiry checker	Checking any site from any device	Days left, issuer, often chain and config problems too	30 seconds
Automatic monitoring	Never forgetting again	An alert before the date, plus uptime checks	2 minutes, once

Method 1: Check the SSL certificate expiration date in your browser

Every desktop browser can show the certificate a site is using. The menus differ a little, so here are the exact clicks.

Google Chrome

1. Open the site and click the icon to the left of the address (the "View site information" icon, which looks like two sliders).
2. Click Connection is secure, then Certificate is valid.
3. In the Certificate Viewer, look under Validity Period. Expires On is the expiry date.

Microsoft Edge

1. Click the padlock to the left of the address.
2. Click Connection is secure, then the small certificate icon in the top corner of the pop-up.
3. Under Validity Period, read Expires On.

Mozilla Firefox

1. Click the padlock, then Connection secure, then More information.
2. In the Page Info window, click View Certificate.
3. A certificate tab opens. Under Validity, Not After is the expiry date.

Safari (Mac)

1. Click the padlock in the address bar, then Show Certificate.
2. Expand Details and look for Not Valid After.

One caveat: the browser shows the certificate your connection received. If your site sits behind a CDN or several servers, other visitors (or your origin server) may be using a different certificate with a different date. The command-line method below lets you check each one directly.

Method 2: Use an openssl command to check certificate expiration

On Mac, Linux, or Windows with WSL or Git Bash, openssl is usually already installed. This is the fastest way to check SSL certificate expiration from the command line, and it's the only method you can script.

Check a live website's expiry date

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate

Here's what each part does:

• s_client -connect example.com:443 opens a TLS connection to the server, just like a browser.
• -servername example.com sends SNI (the hostname). Don't skip it. Servers and CDNs that host many sites pick the certificate by name, so without it you can get the wrong site's certificate.
• `