SSL Certificate Expiry Checker

Tells you exactly how many days remain on an SSL/TLS certificate and flags the ones creeping toward a critical renewal window. An expired cert doesn't just show a browser warning — it breaks HTTPS outright for every visitor, and can take an entire site effectively offline until it's fixed.

Why certificates expire at all

Short validity periods are deliberate: they invalidate a compromised certificate quickly without needing revocation infrastructure to actually work reliably everywhere, they force periodic re-verification of domain ownership, and they keep certificate authority practices and cryptographic standards from going stale. As of recent policy, the maximum validity enforced by Apple, Chrome and Mozilla is 398 days — and Let's Encrypt issues certs valid for just 90 days specifically to push everyone toward automated renewal via ACME rather than manual, error-prone processes.

Renewal practices that actually prevent the 2am incident

• Automate it — Certbot with Let's Encrypt handles renewal without human involvement, configured to kick in around 60 days out
• Set calendar alerts anyway, as a backup — 60 days, 30 days, 7 days remaining, even on automated certs, because automation fails silently more often than people expect
• Monitor your whole certificate estate with something like UptimeRobot, Nagios, Zabbix or Datadog — not just the certs you remember exist
• Never do a first-time renewal with less than 48 hours on the clock — that's when small configuration mistakes turn into outages
• Keep an actual inventory — large organisations lose track of certificates on subdomains and internal services constantly, and those are exactly the ones nobody notices expiring until something breaks

What actually happens when one lapses

Browsers throw an immediate, hard-to-miss warning — Chrome's "Your connection is not private," Firefox's "Warning: Potential Security Risk Ahead" — and depending on HSTS configuration, users may not even be able to click through it. API integrations start failing with SSL verification errors, often with no obvious link back to "the certificate expired" in the error message. The actual cost of that — lost revenue, reputational damage, an emergency out-of-hours fix — is consistently far higher than the five minutes it takes to set a renewal reminder in advance.