SSL Certificate Expiry
Enter your SSL/TLS certificate’s expiry date and get the exact number of days and hours left, a validity status, and the recommended renewal window — before browsers start warning your visitors.
Results
Enter data and click Calculate.
What certificate expiry means
This calculator answers: how many days until expiry — from today to notAfter. It is a countdown, not the certificate’s full lifetime. Certificate expiry ≠ domain registration expiry.
Why renewal planning matters
- An expired certificate blocks traffic — browsers show a full-page warning, not a minor notice.
- APIs and integrations (webhooks, mobile apps with certificate pinning) can start failing TLS handshakes with no visible UI warning at all.
- Manual renewal is easy to miss — which is why the industry keeps moving toward shorter lifetimes and automation (ACME).
Typical certificate validity periods
| Issuer / type | Typical validity | Notes |
|---|---|---|
| Let's Encrypt / ACME | 90 days | Designed for automated renewal (certbot and similar). |
| Commercial CA (DV/OV) | Up to 398 days | Maximum under CA/Browser Forum requirements since 2020. |
| Legacy EV certificates | Up to 2 years (historically) | New issuances now follow the same limits as DV/OV. |
| Internal CA / self-signed | Whatever the organization sets | Not bound by public CA/B Forum limits, but similar discipline still pays off. |
What happens when it expires
Once notAfter passes, browsers (Chrome, Firefox, Safari) block the connection with a warning like "Your connection is not private." Mobile apps and server-to-server clients (curl, HTTP libraries) fail certificate verification and abort the request — often with no user-facing message at all, just an error in a backend log.
When to renew — the ~30-day window
- For 90-day certificates (Let's Encrypt), automation typically renews around 60 days in (about 1/3 of the remaining lifetime).
- For yearly certificates, a common reminder is 30 days before
notAfter— enough time to issue, validate the domain, and deploy. - The calculator shows a recommended renewal window once 60 days or fewer remain.
Examples
- Expires in 45 days, threshold 30 — status "Valid", no renewal window yet.
- Expires in 12 days, threshold 30 — status "Expiring soon", renewal window shown.
- Expired 5 days ago — status "Expired", immediate action required.
FAQ — SSL certificate renewal
- Where do I find the expiry date?
- Browser padlock → "Valid to" /
notAfter. From a file:openssl x509 -enddate -noout -in cert.pem(end date only — use the validity-window calculator for full notBefore/notAfter span). - How is this different from the validity window calculator?
- This tool counts down to a single date (expiry). The validity calculator measures the whole certificate window — issue date through expiry.
- Does 0 days mean it already expired?
- The expiry day itself is treated as the last valid day — 0 means "expires today"; a negative number means it has already expired.
- What threshold should I use for "expiring soon"?
- 30 days works well for yearly certificates. For 90-day Let’s Encrypt certs, consider 20–25 days since automation usually renews earlier.
- Are the hours exact?
- Hours are an approximation (days × 24) based on full calendar days — fine for prioritizing work, not for minute-level SLA accounting.
- The certificate expired but the site still works — why?
- Browsers may cache a TLS session or OCSP response, and some clients (older APIs) don’t re-verify immediately. This is temporary — renew as soon as possible.
- Can I use one calculator run for many domains?
- Check each domain separately — subdomains may use different certificates (or one wildcard) with different expiry dates.
- How do I automate monitoring?
- Use certbot with auto-renewal, an uptime monitor with a TLS-expiry alert, or a cron job that runs
openssland fires an alert once the threshold is crossed.