How to Check SSL Certificate Expiry Date Using OpDeck's SSL Tool

If you need to check an SSL certificate expiry date, you have several options — from browser clicks to command-line tools to dedicated online checkers. This guide walks you through all of them, with a focus on the fastest and most reliable methods, including OpDeck's free SSL Certificate Checker.

SSL certificates are the backbone of secure web communication. When they expire, browsers throw scary warnings, search engines may downrank your site, and visitors lose trust — sometimes permanently. Knowing exactly when your certificate expires is one of the most basic (and most overlooked) tasks in website maintenance.

Why Checking Your SSL Certificate Expiry Date Matters

Before diving into the how, it's worth understanding the stakes. An expired SSL certificate doesn't just cause a minor inconvenience. Here's what actually happens:

Browser warnings: Chrome, Firefox, Safari, and Edge all display full-page "Your connection is not private" warnings when a certificate expires. Most users will immediately leave.
SEO impact: HTTPS is a confirmed Google ranking signal. While Google doesn't actively penalize expired certs in a direct ranking drop, the resulting traffic loss from user abandonment and potential crawl issues can hurt your organic visibility.
API failures: If your backend services communicate over HTTPS, an expired cert can silently break integrations, payment gateways, or third-party APIs.
Email deliverability: Mail servers that rely on TLS certificates for secure SMTP connections can fail to send or receive email when certs expire.

Certificate lifetimes have also been getting shorter. As of 2024, most publicly trusted certificates are issued with a maximum validity of 398 days. Apple, Google, and Mozilla are actively pushing for even shorter lifetimes — potentially 90 days or less in the near future. That means more frequent renewals and more opportunities to accidentally miss an expiry.

Staying on top of your SSL certificate expiry date is no longer optional. It's routine hygiene.

Method 1: Check SSL Certificate Expiry Using OpDeck's SSL Tool

The quickest way to check an SSL certificate expiry date for any domain is to use the SSL Certificate Checker at OpDeck. No installation, no command line, no digging through browser menus — just enter a domain and get the full picture in seconds.

How to Use OpDeck's SSL Certificate Checker

Go to https://www.opdeck.co/tools/ssl
Enter the domain name you want to inspect — for example, example.com. You don't need to include https://.
Click "Check" and wait a few seconds while the tool connects to the server and retrieves the certificate details.
Review the results, which include:
- Certificate expiry date (the exact date and time)
- Days remaining until expiry
- Certificate issuer (e.g., Let's Encrypt, DigiCert, Sectigo)
- Domain the certificate is issued to
- Whether the certificate is currently valid and trusted
- Subject Alternative Names (SANs) — the list of domains covered by the cert

This is particularly useful if you're checking a domain you don't own or manage, such as a client's site, a vendor's API endpoint, or a competitor's domain. You don't need access to the server or hosting account.

What the Results Tell You

When you run a check, pay attention to these fields:

Valid Until: This is your expiry date. If it's within 30 days, you should be planning a renewal. If it's within 7 days, you should be renewing immediately.
Days Remaining: A quick at-a-glance number. Anything under 30 is a yellow flag; under 14 is a red flag.
Issuer: Knowing who issued the cert helps you know where to go for renewal. Let's Encrypt certs auto-renew via Certbot or hosting panel integrations. Commercial certs from DigiCert or Sectigo require manual renewal or a paid service.
SANs: If your site runs on multiple subdomains (e.g., www.example.com, api.example.com, mail.example.com), make sure they're all covered by the same certificate or have their own valid certs.

Method 2: Check SSL Certificate Expiry Date in Your Browser

Every major browser lets you inspect the SSL certificate of any site you're visiting. This is useful for a quick sanity check when you're already on the site.

Google Chrome

Click the padlock icon (or the info icon) in the address bar to the left of the URL.
Click "Connection is secure".
Click "Certificate is valid".
A certificate details panel opens. Look for the "Valid to" field under the "General" tab — this is your expiry date.

Mozilla Firefox

Click the padlock icon in the address bar.
Click the right arrow next to "Connection secure".
Click "More information".
In the Page Info window, click "View Certificate".
Firefox opens a dedicated certificate viewer. Look for the "Expires On" field.

Safari (macOS)

Click the padlock icon in the address bar.
Click "Show Certificate".
Expand the certificate details to find the "Expires" field.

The browser method works fine for your own browsing, but it requires you to actually visit the site. It won't work for domains that are down, subdomains you can't navigate to directly, or API endpoints that don't serve web pages.

Method 3: Check SSL Certificate Expiry Using the Command Line

If you prefer working in a terminal — or need to automate certificate checks across multiple domains — the command line is your best option.

Using OpenSSL

OpenSSL is the standard tool for TLS/SSL inspection. It's available on macOS, Linux, and Windows (via WSL or Git Bash).

Basic command to retrieve and display certificate details:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

This outputs something like:

notBefore=Jan  1 00:00:00 2024 GMT
notAfter=Dec 31 23:59:59 2024 GMT

The notAfter value is your expiry date.

To display just the expiry date in a cleaner format:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

Output:

notAfter=Dec 31 23:59:59 2024 GMT

To check how many days remain until expiry:

EXPIRY=$(echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$EXPIRY" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))
echo "Days until expiry: $DAYS_LEFT"

This script works on both Linux (using date -d) and macOS (using date -j). Note the conditional syntax handles the difference between GNU date and BSD date.

Using curl

If OpenSSL isn't available or you want a simpler one-liner, curl can also retrieve certificate information:

curl -vI --stderr - https://example.com 2>&1 | grep -i "expire date"

This uses curl's verbose mode and greps for the expiry line. The output looks like:

*  expire date: Dec 31, 2024

Checking Multiple Domains at Once

If you manage a portfolio of sites, you can loop through a list of domains:

domains=("example.com" "mysite.org" "api.myservice.io")

for domain in "${domains[@]}"; do
  EXPIRY=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
  echo "$domain: $EXPIRY"
done

This gives you a quick overview of all your certificates in one go.

Method 4: Check SSL Certificate Expiry via Your Hosting Panel or Certificate Authority

If you purchased or provisioned your SSL certificate through a hosting provider or certificate authority, you can often check (and manage) expiry dates directly in their dashboard.

cPanel / Plesk

Most shared hosting providers use cPanel or Plesk. In cPanel:

Log in to your cPanel account.
Navigate to Security > SSL/TLS.
Click "Manage SSL sites".
You'll see a list of your domains with their installed certificates, including expiry dates.

In Plesk:

Go to Websites & Domains.
Click SSL/TLS Certificates for the domain in question.
The certificate details, including the expiry date, are listed there.

Let's Encrypt via Certbot (Linux Server)

If you're running your own server with Certbot managing Let's Encrypt certificates:

sudo certbot certificates

This outputs all managed certificates with their expiry dates:

Found the following certs:
  Certificate Name: example.com
    Domains: example.com www.example.com
    Expiry Date: 2024-12-31 12:00:00+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem

Checking a Local Certificate File

If you have a .pem or .crt file on disk and want to check its expiry without connecting to a server:

openssl x509 -in /path/to/certificate.pem -noout -enddate

This is useful for certificates stored locally before deployment, or for internal/private certificates not exposed to the internet.

Method 5: Set Up Automated SSL Expiry Monitoring

Manually checking SSL certificate expiry dates is fine for small setups, but if you manage more than a handful of domains, automation is the way to go.

Simple Cron Job with Email Alert

Here's a basic shell script you can run as a daily cron job:

#!/bin/bash
DOMAINS=("example.com" "api.example.com" "shop.example.com")
ALERT_DAYS=30
EMAIL="[email protected]"

for domain in "${DOMAINS[@]}"; do
  EXPIRY=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
  EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$EXPIRY" +%s)
  NOW_EPOCH=$(date +%s)
  DAYS_LEFT=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))

  if [ "$DAYS_LEFT" -lt "$ALERT_DAYS" ]; then
    echo "WARNING: SSL certificate for $domain expires in $DAYS_LEFT days ($EXPIRY)" | mail -s "SSL Expiry Alert: $domain" "$EMAIL"
  fi
done

Add it to cron with crontab -e:

0 8 * * * /path/to/ssl-check.sh

This runs every morning at 8am and sends an email if any certificate is expiring within 30 days.

Third-Party Monitoring Services

Several monitoring services offer SSL expiry alerts as part of their uptime monitoring packages. These typically check your certificates on a schedule and notify you via email, Slack, or PagerDuty when expiry is approaching. Popular options include UptimeRobot (free tier available), Better Uptime, and StatusCake.

Common SSL Certificate Expiry Issues and How to Fix Them

Certificate Already Expired

If your certificate has already expired, you need to renew it immediately:

Let's Encrypt: Run sudo certbot renew --force-renewal
cPanel AutoSSL: Log in to cPanel, go to SSL/TLS > Manage AutoSSL, and trigger a manual run
Commercial cert: Log in to your CA's portal, renew the certificate, download it, and reinstall it on your server

Certificate Renewed but Old One Still Showing

After renewal, your server may still be serving the old certificate. This usually means the web server hasn't been reloaded. For Nginx:

sudo nginx -t && sudo systemctl reload nginx

For Apache:

sudo apachectl configtest && sudo systemctl reload apache2

Certificate Valid but Not Trusted

If the certificate is within its validity period but browsers still show a warning, the issue is likely a missing intermediate certificate. The cert chain is incomplete. Check with OpDeck's SSL Certificate Checker — it will flag chain issues in addition to expiry problems.

Wildcard vs. Individual Domain Certs

A wildcard certificate (*.example.com) covers all first-level subdomains but not the root domain itself or nested subdomains (sub.sub.example.com). If you're seeing expiry or trust issues on specific subdomains, verify which certificate is actually being served using the OpenSSL command or OpDeck's tool.

How to Check SSL Certificate Expiry Date: Quick Reference

Here's a summary of all the methods covered:

Method	Best For	Requires
OpDeck SSL Tool	Any domain, fast, no setup	Browser
Browser inspector	Sites you're actively visiting	Browser
OpenSSL command	Automation, scripting, servers	Terminal + OpenSSL
curl	Quick checks, CI/CD pipelines	Terminal + curl
Hosting panel	Certs you manage via cPanel/Plesk	Hosting account access
Certbot	Let's Encrypt on Linux servers	Root/sudo access
Local file inspection	Pre-deployment cert validation	OpenSSL + cert file

Conclusion

Knowing how to check an SSL certificate expiry date is a fundamental skill for anyone who manages websites, APIs, or servers. Whether you prefer a no-setup online tool, a browser click, or a terminal command, there's a method that fits your workflow.

For the fastest and most complete check — especially if you're auditing a site you don't directly manage — the SSL Certificate Checker at OpDeck gives you everything you need in one place: expiry date, days remaining, issuer details, SANs, and chain validity. No account needed, no installation, just results.

Head over to OpDeck and run a check on your domains today. It takes about ten seconds, and it might save you from a very bad day.