Check expiry, chain and renewal status of TLS certificates across every server behind a hostname.
Public TLS certificate lifetimes are shrinking: 200 days since March 2026, 100 days from March 2027 and 47 days from March 2029. Renewal must be automated, and the result verified. Read more
| Effective | Max lifetime |
|---|---|
| 2026-03-15 | 200 days |
| 2027-03-15 | 100 days |
| 2029-03-15 | 47 days |
Enter the hostname above and press Check. The expiry date and days remaining are shown for every IP address of the host. You can also use openssl or this site's API; see the guide on how to check certificate expiry.
Usually the web server was not reloaded after renewal, or only some servers behind a load balancer or DNS round robin were updated. This checker connects to every address and reports a mismatch when servers present different certificates.
By the remaining share of the certificate lifetime rather than a fixed number of days: under one third is renewal due, under 10% (or 3 days) is critical. This keeps working as lifetimes shrink to 47 days.
Under CA/Browser Forum Ballot SC-081 the maximum is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029.
Yes. The web checker and the API are free for personal and commercial use within the rate limits.
No. For security reasons only public internet addresses are checked. Private, loopback and other non-public addresses are refused.