How to Check SSL Certificate Expiry Date Using OpDeck's SSL Tool

If you need to check an SSL certificate expiry date quickly and accurately, you have several options — from browser-based inspection to command-line tools to dedicated online checkers. This guide walks you through every method, explains what the expiry date actually means for your site, and shows you how to stay ahead of certificate renewals before they cause downtime or browser warnings.

Why SSL Certificate Expiry Dates Matter

An expired SSL certificate is one of the most avoidable website problems, yet it happens constantly — even to experienced developers and sysadmins. When a certificate expires, visitors see a browser security warning instead of your website. That warning kills trust instantly, and most users will leave rather than click through.

Beyond user trust, an expired certificate can:

Break API integrations that enforce strict TLS validation
Trigger monitoring alerts and on-call pages in the middle of the night
Cause search engine crawlers to flag your site as insecure
Invalidate payment processing flows that require valid HTTPS

Certificates typically have lifespans of 90 days (Let's Encrypt) or 1 year (commercial CAs). The 90-day model is increasingly common because it encourages automation, but it also means the renewal window closes faster than you might expect.

How to Check SSL Certificate Expiry Date Using OpDeck

The fastest way to check an SSL certificate expiry date is with the SSL Certificate Checker on OpDeck. No installation, no command-line knowledge required — just enter a domain and get a full certificate report in seconds.

Step-by-Step: Using OpDeck's SSL Certificate Checker

Open the tool — Navigate to OpDeck SSL Certificate Checker.
Enter your domain — Type the full domain name (e.g., example.com or api.example.com). You don't need to include https://.
Run the check — Click the analyze button and wait a few seconds.
Read the results — The tool returns the certificate's expiry date, issuer, subject, validity period, and whether the certificate is currently valid.

What the Results Tell You

The OpDeck SSL checker surfaces several critical pieces of information:

Expiry date — The exact date and time (UTC) when the certificate becomes invalid.
Days remaining — A countdown showing how many days are left before expiry. This is the most actionable number.
Issuer — The Certificate Authority (CA) that signed the certificate (e.g., Let's Encrypt, DigiCert, Sectigo).
Subject / Common Name — The domain the certificate was issued for.
SANs (Subject Alternative Names) — Additional domains or subdomains covered by the certificate.
Certificate chain validity — Whether the full chain from root to leaf certificate is intact.

If the days remaining is under 30, treat it as urgent. If it's under 7, treat it as a fire drill.

How to Check SSL Certificate Expiry Date from the Browser

You don't always need a tool. Every major browser lets you inspect a certificate directly from the address bar.

Google Chrome

Click the padlock icon (or the info icon) in the address bar.
Click "Connection is secure".
Click "Certificate is valid".
In the certificate viewer, look at the "Valid from" and "Valid to" fields under the "General" tab.

Mozilla Firefox

Click the padlock icon in the address bar.
Click "Connection secure", then "More information".
In the Page Info window, click "View Certificate".
A new tab opens with the full certificate details, including the validity period.

Microsoft Edge

Click the lock icon in the address bar.
Select "Connection is secure".
Click "Certificate is valid" to open the certificate viewer.

The browser method is useful for a quick spot-check on a page you're already visiting, but it doesn't help you check certificates on domains you're not browsing, and it won't give you bulk checking or automated alerts.

How to Check SSL Certificate Expiry Date Using the Command Line

For developers and sysadmins who prefer terminal-based workflows, openssl is the standard tool. It's available on Linux, macOS, and Windows (via WSL or Git Bash).

Using openssl s_client

The most direct command to check a certificate's expiry date:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

This outputs something like:

notBefore=Jan  1 00:00:00 2024 GMT
notAfter=Mar 31 23:59:59 2025 GMT

The notAfter line is the expiry date. The -servername flag is critical for servers hosting multiple domains via SNI (Server Name Indication) — without it, you might get the wrong certificate.

Checking a Certificate File Directly

If you have the certificate file (.crt or .pem) on disk, you can inspect it without making a network connection:

openssl x509 -in /path/to/certificate.crt -noout -dates

Or for a more human-readable output:

openssl x509 -in /path/to/certificate.crt -noout -text | grep -A 2 "Validity"

Getting Just the Expiry Date as a Timestamp

If you're scripting certificate monitoring, you might want just the expiry date in a parseable format:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate \
  | cut -d= -f2

Output:

Mar 31 23:59:59 2025 GMT

Checking Certificate Expiry with curl

curl can also display certificate information, though it's less detailed than openssl:

curl -vI https://example.com 2>&1 | grep -i "expire"

Or to see the full SSL handshake details:

curl --cert-status -vI https://example.com 2>&1 | grep -A 5 "SSL certificate"

How to Check SSL Certificate Expiry Date for Multiple Domains

If you manage more than a handful of domains, checking them one by one is unsustainable. Here are practical approaches for bulk checking.

Bash Script for Multiple Domains

Create a file called domains.txt with one domain per line, then run this script:

#!/bin/bash

while IFS= read -r domain; do
  expiry=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null \
    | cut -d= -f2)
  
  if [ -z "$expiry" ]; then
    echo "$domain: FAILED TO RETRIEVE CERTIFICATE"
  else
    # Convert to epoch for comparison
    expiry_epoch=$(date -d "$expiry" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$expiry" +%s)
    now_epoch=$(date +%s)
    days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
    echo "$domain: expires $expiry ($days_left days remaining)"
  fi
done < domains.txt

This script outputs a line for each domain showing the expiry date and days remaining. Pipe it to a file or integrate it into a cron job.

Setting Up a Cron Job for Automated Checks

Add this to your crontab (crontab -e) to run the check every Monday morning and email you the results:

0 8 * * 1 /path/to/check_certs.sh | mail -s "Weekly SSL Certificate Report" [email protected]

For more sophisticated alerting, you can modify the script to only output domains with fewer than 30 days remaining, reducing noise.

Checking SSL Certificate Expiry for Non-HTTPS Ports

HTTPS isn't the only protocol that uses TLS certificates. If you're running mail servers, LDAP, or other TLS-secured services, you need to check those certificates too.

SMTP (Port 465 or 587)

echo | openssl s_client -connect mail.example.com:465 2>/dev/null | openssl x509 -noout -dates

For STARTTLS on port 587:

echo | openssl s_client -connect mail.example.com:587 -starttls smtp 2>/dev/null | openssl x509 -noout -dates

IMAP (Port 993)

echo | openssl s_client -connect mail.example.com:993 2>/dev/null | openssl x509 -noout -dates

LDAPS (Port 636)

echo | openssl s_client -connect ldap.example.com:636 2>/dev/null | openssl x509 -noout -dates

The pattern is always the same — change the hostname and port number. The -starttls flag is needed for protocols that upgrade to TLS mid-connection rather than starting with TLS.

Understanding Certificate Validity Windows and Renewal Timing

Knowing how to check SSL certificate expiry date is only half the picture. Understanding when to act on what you find is equally important.

The 90-Day Certificate Lifecycle (Let's Encrypt)

Let's Encrypt certificates are valid for 90 days. The recommended renewal window starts at 30 days before expiry. If you're using Certbot or another ACME client, renewal is typically automated, but automation can fail silently.

Always verify that your automated renewal is actually working. A common failure mode: the renewal runs successfully in staging, but a firewall rule or DNS change breaks the HTTP-01 or DNS-01 challenge in production.

The 1-Year Commercial Certificate Lifecycle

Commercial certificates from DigiCert, Sectigo, or GlobalSign are typically valid for 397 days (approximately 13 months — the maximum allowed by browsers since 2020). Start the renewal process at least 30 days before expiry to account for validation time and deployment steps.

What "Valid From" Tells You

The notBefore date matters too. If a certificate's start date is in the future, clients will reject it as invalid even though it hasn't technically "expired." This can happen when certificates are issued in advance and deployed too early, or when server clocks are misconfigured.

Common SSL Certificate Expiry Problems and How to Fix Them

Problem: Certificate Expired Overnight

This usually means automated renewal failed. Check:

Is the ACME client (Certbot, acme.sh) still installed and configured?
Did the renewal cron job or systemd timer run recently? Check logs: journalctl -u certbot.timer
Is port 80 open for HTTP-01 challenges?
Did a recent DNS change break DNS-01 challenges?

Problem: Certificate Shows as Expired But You Just Renewed

The server may still be serving the old certificate. After renewal, restart the web server:

sudo systemctl reload nginx
# or
sudo systemctl reload apache2

Some servers cache the certificate in memory and need a full restart, not just a reload.

Problem: Different Expiry Dates on Different Servers

If you're behind a load balancer or CDN, different nodes might have different certificates. The OpDeck SSL Certificate Checker checks the certificate as seen from the outside, which reflects what your users actually see. Use it alongside internal checks to confirm consistency.

Problem: Certificate Valid But Browser Shows Warning

If the certificate itself is valid but browsers still warn, the issue is likely the certificate chain. The intermediate certificate might be missing or incorrectly ordered. The OpDeck SSL tool checks chain validity and will flag this.

Integrating SSL Expiry Checks into Your Monitoring Stack

For production environments, manual checks aren't enough. SSL certificate expiry should be part of your monitoring infrastructure.

Prometheus + Blackbox Exporter

The Prometheus Blackbox Exporter can probe HTTPS endpoints and expose certificate expiry as a metric:

modules:
  https_2xx:
    prober: http
    http:
      tls_config:
        insecure_skip_verify: false

Then create an alert rule:

- alert: SSLCertificateExpiringSoon
  expr: probe_ssl_earliest_cert_expiry - time() < 86400 * 30
  for: 1h
  labels:
    severity: warning
  annotations:
    summary: "SSL certificate expiring in less than 30 days for {{ $labels.instance }}"

Nagios / Icinga

The check_http plugin with the -C flag checks certificate expiry:

check_http -H example.com --ssl -C 30,14

This triggers a warning when fewer than 30 days remain and a critical alert when fewer than 14 days remain.

Datadog

Datadog's HTTP check supports SSL certificate monitoring natively. Enable it in your http_check.yaml configuration:

instances:
  - name: example.com
    url: https://example.com
    ssl_expire: true
    days_warning: 30
    days_critical: 14

How to Check SSL Certificate Expiry Date: A Quick Reference

Here's a summary of all the methods covered in this guide:

Method	Best For	Command / URL
OpDeck SSL Checker	Quick checks, no setup required	opdeck.co/tools/ssl
Browser inspector	Pages you're actively visiting	Padlock icon → Certificate
openssl s_client	Terminal users, scripting	`openssl s_client -connect host:443`
Bash script	Bulk domain checking	Loop with openssl
Prometheus Blackbox	Production monitoring	Metric: `probe_ssl_earliest_cert_expiry`
Nagios check_http	Alerting infrastructure	`check_http -C 30,14`

Conclusion

Knowing how to check SSL certificate expiry date is a foundational skill for anyone running a website, API, or any TLS-secured service. Whether you prefer a quick browser inspection, a terminal command, or a fully automated monitoring pipeline, the core information you need is always the same: the notAfter date and how many days remain.

The most important habit to build is checking proactively — not after users start reporting browser warnings. Set a reminder, automate a script, or add it to your monitoring stack. For the fastest no-setup check, the OpDeck SSL Certificate Checker gives you expiry date, issuer details, chain validity, and days remaining in seconds. Bookmark it, use it regularly, and make expired certificates a problem you never have to deal with again.