Check SSL Certificate Expiration: Verify & Fix SSL Errors

An expired SSL certificate can cause browser security warnings, failed HTTPS connections, and lost trust from visitors. If you manage a website, knowing how to check SSL certificate expiration helps you renew certificates before they become a problem.

The quickest method is to enter your domain into an online SSL checker and review the certificate status, expiration date, and remaining validity. You can also inspect a certificate through your browser or use OpenSSL when you need command-line access.

This guide explains all three methods, how to tell whether an SSL certificate is valid, what happens when a certificate expires, and how to troubleshoot common SSL errors.

What Is an SSL Certificate Expiration Date?

An SSL certificate has a defined certificate validity period. It becomes valid at a specific date and time and stops being valid after its expiration date.

Technically, modern HTTPS websites use TLS certificates, although “SSL certificate” remains the more common term used by website owners and in search queries. HTTPS uses TLS to create an encrypted connection between a visitor's browser and the website. Mozilla explains that browsers also use certificates to verify the identity associated with the website they are connecting to.

When examining a certificate, you may see two important values:

• Not Before: The date and time when the certificate starts being valid.
• Not After: The date and time when the certificate expires.

OpenSSL documentation identifies notAfter as the certificate's expiry date.

If the current time is later than the Not After value, the certificate has expired.

How to Check SSL Certificate Expiration

There are three practical ways to check an SSL certificate's expiration date:

1. Use an online SSL checker.
2. Inspect the certificate in your browser.
3. Check it through OpenSSL.

For most website owners, an online checker is the fastest option. Developers and system administrators may prefer OpenSSL because it can be used from the command line or integrated into monitoring workflows.

Method 1: Check SSL Expiration With an Online SSL Checker

If you only need to know whether a public website has an active certificate and when it expires, an online checker avoids command-line work.

You can use theConvixPro SSL Checker to inspect the certificate presented by a public domain.

To check a certificate:

1. Enter a domain such as example.com or a supported HTTPS address.
2. Start the SSL certificate check.
3. Review whether a certificate was detected.
4. Check its current status.
5. Review the certificate expiration date and remaining validity shown in the result.

The ConvixPro checker may display information such as the certificate's valid-from date, expiration date, remaining time, current status, and connection or certificate errors detected during the lookup.

For example, imagine that a checker returns:

Result	Example
Certificate status	Valid
Expiration status	Expires soon
Time remaining	18 days

The certificate has not expired yet, but the short remaining period means you should review its renewal process rather than waiting for the final day.

An online expiration check is useful for a quick diagnosis, but it should not be treated as a complete TLS security audit. A certificate can be within its valid date range and still have problems with its hostname, trust chain, deployment, or server configuration.

Method 2: Check an SSL Certificate in Your Browser

Modern browsers can display certificate information for the HTTPS website you are visiting.

The exact interface changes between browser versions, but the general process is:

1. Open the HTTPS website.
2. Open the browser's connection or site-security information.
3. View the certificate details.
4. Find the validity or expiration information.
5. Confirm that the domain you are visiting is covered by the certificate.

For example, Firefox's Site Information interface provides connection-security information and access to certificate details. Certificate information can include the issuer, validity period, subject, and Subject Alternative Names.

The browser method is especially useful when you want to inspect the same certificate that visitors are receiving.

However, browsers are less convenient if you need to check many domains regularly.

Method 3: Check SSL Certificate Expiration With OpenSSL

OpenSSL is useful for developers, server administrators, and technical users who want to inspect certificates from the command line.

If you already have a certificate file, you can display its expiration date with:

openssl x509 -in certificate.pem -noout -enddate

The -enddate option prints the certificate's notAfter value, which represents its expiration date.

On a typical Linux or macOS shell, you can also inspect the certificate presented by a remote HTTPS server. For example:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Replace example.com with the hostname you want to inspect.

For automated checks, OpenSSL also provides -checkend. It can test whether a certificate will expire within a specified number of seconds. For example, 30 days equals 2,592,000 seconds:

openssl x509 -in certificate.pem -noout -checkend 2592000

OpenSSL returns a different exit status depending on whether the certificate will expire within that period, making this method useful in scripts and monitoring systems.

Which SSL Checking Method Should You Use?

The right method depends on what you are trying to accomplish.

Method	Best For	Main Advantage	Limitation
Online SSL checker	Website owners, marketers, quick checks	Fast and simple	May not perform every TLS validation
Browser	Checking the site you are currently visiting	Shows certificate information from the live connection	Inefficient for many domains
OpenSSL	Developers and administrators	Detailed and scriptable	Requires command-line knowledge

If you simply need the certificate expiration date, an online SSL checker is usually enough.

If visitors are reporting warnings, also inspect the certificate through a browser. For deeper server diagnostics or automation, OpenSSL is more appropriate.

How to Check If an SSL Certificate Is Valid

Expiration is only one part of certificate validity.

A certificate may still produce errors even when its expiration date is months away. Browsers validate several aspects of the certificate and its relationship to the website.

A healthy public HTTPS setup generally requires:

• The certificate to be within its validity period.
• The certificate to cover the hostname being visited.
• The issuing Certificate Authority (CA) to be trusted.
• The server to provide the required certificate chain.
• The correct certificate to be installed on the active server or proxy.

Mozilla describes browser validation as a chain of trust involving the website certificate, intermediate certificates, and a trusted root certificate. The browser also checks that the website being visited matches the identity in the certificate.

This is why seeing a future expiration date does not automatically prove that the whole HTTPS configuration is correct.

What Happens When an SSL Certificate Expires?

When an SSL certificate expires, browsers can no longer treat it as currently valid based on its validity period.

Visitors may encounter a security warning instead of the website they expected to see. Firefox, for example, documents an expired-certificate error when a site's identity certificate has passed its expiration date.

Depending on the browser, application, and configuration, an expired certificate can lead to:

• Browser certificate warnings.
• Failed HTTPS connections.
• API or application connection failures.
• Interrupted logins, payments, or other HTTPS-dependent workflows.
• Users leaving rather than proceeding past a warning.

For website owners, the practical lesson is simple: renew before expiration and verify the live certificate after renewal.

Do not assume the job is complete merely because your hosting panel says a new certificate was issued.

How to Fix an Expired SSL Certificate

If your SSL certificate has already expired, work through the problem in this order.

1. Confirm the Certificate That Is Actually Expired

First, check the exact hostname showing the problem.

example.com, www.example.com, and shop.example.com are different hostnames. They may not all be using the same certificate or server configuration.

Check the affected hostname and note its expiration date.

2. Renew or Replace the Certificate

Use the certificate management system provided by your hosting company, Certificate Authority, CDN, control panel, or ACME client.

If automatic certificate renewal is enabled, investigate why it did not complete successfully rather than simply running the same process again.

Potential causes include DNS changes, failed domain validation, server migration, configuration changes, or certificate deployment problems.

3. Install the New Certificate on the Correct Endpoint

Issuing a new certificate does not necessarily mean visitors are receiving it.

Websites may serve HTTPS through:

• A CDN
• Reverse proxy
• Load balancer
• Multiple web servers
• Separate IPv4 and IPv6 endpoints

If one endpoint still serves the old certificate, some visitors or checking tools may continue to report the previous expiration date.

4. Recheck the Live Website

After renewal and installation, run another certificate check against the public hostname.

Confirm that the expiration date has changed and the live server is returning the new certificate.

Then open the HTTPS website in a browser and check for warnings.

Common SSL Certificate Errors and How to Fix Them

Not every SSL error is caused by expiration. If a certificate appears current but the website still produces an HTTPS warning, investigate these common problems.

SSL Certificate Name Mismatch

A hostname mismatch happens when the certificate does not cover the hostname being requested.

For example, a certificate might cover:

example.com

but not:

portal.example.com

Public certificates commonly use Subject Alternative Name entries to specify the hostnames they cover. Cloudflare's certificate documentation notes that hostnames need appropriate SAN coverage for certificate validation and deployment.

How to fix it: Obtain or configure a certificate that covers every hostname visitors actually use, then make sure the correct certificate is being served for that hostname.

SSL Certificate Not Trusted

A certificate can be unexpired but still fail browser trust checks.

Possible causes include:

• A self-signed certificate on a public website.
• A certificate from an untrusted issuer.
• Missing intermediate certificates.
• Incorrect certificate-chain configuration.
• Security software or a network device replacing certificates.

Mozilla notes that unknown issuers and self-signed certificates can trigger certificate security warnings.

How to fix it: For a public website, use a certificate that chains correctly to a Certificate Authority trusted by major browsers, and verify that the required intermediate certificates are configured correctly.

Incomplete Certificate Chain

Your server certificate may be valid while the server fails to provide the intermediate certificates needed for a browser to build a trusted chain.

Some clients may still connect while others fail, which can make this problem difficult to identify.

How to fix it: Verify the certificate bundle or chain configured on your web server, proxy, CDN, or load balancer. Install the required intermediate certificate according to your CA or hosting provider's instructions.

“Your Connection Is Not Private” Warning

A browser warning such as “Your connection is not private” is a symptom rather than one specific SSL problem.

Possible causes include an expired certificate, incorrect hostname, trust failure, server configuration issue, or even a problem on the visitor's device or network.

An incorrect computer date and time can also make a valid certificate appear expired or not yet valid because certificate checks depend on time. Mozilla specifically recommends checking the system clock when investigating time-related certificate errors.

How to fix it: Check the certificate first. If the certificate is valid for other users, verify the affected device's date, time, security software, and network environment.

SSL Certificate Renewal Mistakes to Avoid

Many certificate outages happen during renewal rather than initial setup.

A few habits can prevent most avoidable problems:

Waiting until the expiration day. Renew early enough to leave time for troubleshooting.

Assuming automatic renewal always works. Automation reduces manual work, but failed validation or deployment can still interrupt renewal.

Checking only the root domain. Test the actual hostnames users visit, including www and important subdomains.

Renewing without verifying deployment. A renewed certificate stored in a control panel is useless if the live server still presents the old one.

Ignoring multi-server setups. If traffic is distributed across several servers or proxies, ensure every relevant endpoint is updated.

Treating expiration as a complete security test. An expiration checker does not necessarily test hostname matching, certificate chains, protocol versions, cipher suites, revocation, mixed content, or every server behind a domain. ConvixPro's tool documentation makes the same distinction between expiration information and complete TLS validation.

SSL Certificate Expiration Monitoring Best Practices

Checking certificates manually works for a small website, but it becomes harder as the number of domains and subdomains grows.

A practical SSL certificate expiration monitoring workflow should include:

1. Keep an inventory of important HTTPS hostnames.
2. Enable automatic renewal where your certificate provider supports it.
3. Monitor certificates before their expiration dates.
4. Alert the responsible person or team early enough to investigate failures.
5. Verify the live certificate after every renewal or infrastructure change.

Also run an additional SSL check after changing DNS, moving hosting providers, adding a CDN, changing a reverse proxy, or launching a new subdomain.

These changes can affect which certificate is actually presented to visitors.

Keep SSL Expiration From Becoming an Outage

Checking an SSL certificate takes only a short time, but it can reveal an approaching expiration before visitors encounter HTTPS warnings.

Start with the expiration date and remaining validity. If the certificate is expired, renew it, deploy the replacement to the correct server, and verify the live hostname again. If the certificate has not expired but browsers still show errors, investigate hostname coverage, the certificate chain, trust, and server configuration.

For a quick public-domain check,review your website's certificate status and expiration details with the free ConvixPro SSL Checker.

Frequently Asked Questions

How do I know when my SSL certificate expires?

Check the certificate's expiration or notAfter date. You can view it with an online SSL checker, inspect the certificate through your browser, or use OpenSSL with the -enddate option.

How can I check if an SSL certificate is valid?

Start by checking that the certificate is currently within its validity period. Then confirm that it covers the requested hostname, chains to a trusted Certificate Authority, and is correctly installed on the server. A future expiration date alone does not prove complete certificate validity.

How often should I check SSL certificate expiration?

There is no single schedule that fits every website. Automated monitoring is preferable for important production websites, while manual checks are useful after renewals, migrations, DNS changes, CDN changes, or when troubleshooting browser warnings.

Can an SSL certificate be valid but still cause an error?

Yes. A certificate can be within its validity period but still cause errors because of a hostname mismatch, missing intermediate certificate, untrusted issuer, incorrect deployment, or another TLS configuration problem.

Why does my SSL checker show an old expiration date after renewal?

The renewed certificate may not yet be installed on the endpoint being checked. A CDN, load balancer, reverse proxy, secondary server, or another network endpoint may still be serving the old certificate. Check the live hostname again and verify each relevant endpoint.

What is the difference between an SSL certificate and a TLS certificate?

TLS is the modern protocol used to secure HTTPS connections. “SSL certificate” remains a commonly used name for the website certificate involved in that connection, even though modern browsers use TLS rather than the obsolete SSL protocols.

Is an online SSL checker enough for a complete security audit?

No. An online expiration checker is useful for checking certificate status and dates, but a full TLS assessment can include hostname validation, certificate-chain verification, protocol and cipher configuration, revocation status, and other server-security checks.