SSL certificate expiry checker

See the exact date a site's SSL certificate expires and how many days are left before visitors get a warning.

Try:

Results for expired.badssl.com

Checked 2026-11-15live lookup355 ms

Action needed

Expired 4235 days ago

This certificate ran out on 2015-04-12, so browsers are showing visitors a warning. If it’s your site, renewing it (or fixing auto-renew) clears this up.

ExpiredHost name matchesTLS 1.2

Expired

2015-04-12 · 4-day certificate

Chain of trust

3 certificates, from *.badssl.com up to COMODO RSA Certification Authority.

Protocol

TLS 1.2

ECDHE-RSA-AES128-GCM-SHA256

Issuer

COMODO CA Limited

COMODO RSA Domain Validation Secure Server CA

Names covered

2names

*.badssl.com, badssl.com

The certificate expired 4235 days ago (2015-04-12). Browsers block the site with NET::ERR_CERT_DATE_INVALID. Fix: Renew the certificate and install the new one, then reload the web server. With an ACME client such as certbot, check why automatic renewal did not run.

Certificate

Subject: *.badssl.com
Issuer: COMODO RSA Domain Validation Secure Server CA
Valid from: 2015-04-09
Valid until: 2015-04-12 (4,235 days ago)
Public key: RSA 2048
Signature: sha256WithRSAEncryption
Serial number: 4AE79549FA9ABE3F100F17A478E16909
SHA-256 fingerprint: BA:10:5C:E0:2B:AC:76:88:8E:CE:E4:7C:D4:EB:79:41:65:3E:9A:C9:93:B6:1B:2E:B3:DC:C8:20:14:D2:1B:4F

Connection

Host: expired.badssl.com:443
Address: 104.154.89.105
Protocol: TLS 1.2
Cipher: ECDHE-RSA-AES128-GCM-SHA256
ALPN: http/1.1
OCSP stapling: No
Verification message: CERT_HAS_EXPIRED

Names2

Names this certificate covers. A browser accepts it only for these.

*.badssl.com
badssl.com

Chain3

#	Role	Subject	Issuer	Valid until
1	Leaf	*.badssl.com	COMODO RSA Domain Validation Secure Server CA	2015-04-12
2	Intermediate	COMODO RSA Domain Validation Secure Server CA	COMODO RSA Certification Authority	2029-02-11
3	Last in chain	COMODO RSA Certification Authority	AddTrust External CA Root	2020-05-30

Structured result (JSON) · 3.4 KB

{
  "host": "expired.badssl.com",
  "port": 443,
  "ip": "104.154.89.105",
  "verdict": "expired",
  "valid": false,
  "authorized": false,
  "hostnameMatch": true,
  "chain": [
    {
      "subject": {
        "OU": "Domain Control Validated, PositiveSSL Wildcard",
        "CN": "*.badssl.com"
      },
      "issuer": {
        "C": "GB",
        "ST": "Greater Manchester",
        "L": "Salford",
        "O": "COMODO CA Limited",
        "CN": "COMODO RSA Domain Validation Secure Server CA"
      },
      "san": [
        "*.badssl.com",
        "badssl.com"
      ],
      "validFrom": "2015-04-09T00:00:00.000Z",
      "validTo": "2015-04-12T23:59:59.000Z",
      "serialNumber": "4AE79549FA9ABE3F100F17A478E16909",
      "fingerprint256": "BA:10:5C:E0:2B:AC:76:88:8E:CE:E4:7C:D4:EB:79:41:65:3E:9A:C9:93:B6:1B:2E:B3:DC:C8:20:14:D2:1B:4F",
      "keyType": "RSA",
      "keyBits": 2048,
      "signatureAlgorithm": "sha256WithRSAEncryption",
      "isCA": false,
      "selfSigned": false
    },
    {
      "subject": {
        "C": "GB",
        "ST": "Greater Manchester",
        "L": "Salford",
        "O": "COMODO CA Limited",
        "CN": "COMODO RSA Domain Validation Secure Server CA"
      },
      "issuer": {
        "C": "GB",
        "ST": "Greater Manchester",
        "L": "Salford",
        "O": "COMODO CA Limited",
        "CN": "COMODO RSA Certification Authority"
      },
      "san": [],
      "validFrom": "2014-02-12T00:00:00.000Z",
      "validTo": "2029-02-11T23:59:59.000Z",
      "serialNumber": "2B2E6EEAD975366C148A6EDBA37C8C07",
      "fingerprint256": "02:AB:57:E4:E6:7A:0C:B4:8D:D2:FF:34:83:0E:8A:C4:0F:44:76:FB:08:CA:6B:E3:F5:CD:84:6F:64:68:40:F0",
      "keyType": "RSA",
      "keyBits": 2048,
      "signatureAlgorithm": "sha384WithRSAEncryption",
      "isCA": true,
      "selfSigned": false
    },
    {
      "subject": {
        "C": "GB",
        "ST": "Greater Manchester",
        "L": "Salford",
        "O": "COMODO CA Limited",
        "CN": "COMODO RSA Certification Authority"
      },
      "issuer": {
        "C": "SE",
        "O": "AddTrust AB",
        "OU": "AddTrust External TTP Network",
        "CN": "AddTrust External CA Root"
      },
      "san": [],
      "validFrom": "2000-05-30T10:48:38.000Z",
      "validTo": "2020-05-30T10:48:38.000Z",
      "serialNumber": "2766EE56EB49F38EABD770A2FC84DE22",
      "fingerprint256": "4F:32:D5:DC:00:F7:15:25:0A:BC:C4:86:51:1E:37:F5:01:A8:99:DE:B3:BF:7E:A8:AD:BB:D3:AE:F1:C4:12:DA",
      "keyType": "RSA",
      "keyBits": 4096,
      "signatureAlgorithm": "sha384WithRSAEncryption",
      "isCA": true,
      "selfSigned": false
    }
  ],
  "issues": [
    {
      "severity": "error",
      "code": "EXPIRED",
      "message": "The certificate expired 4235 days ago (2015-04-12). Browsers block the site with NET::ERR_CERT_DATE_INVALID.",
      "fix": "Renew the certificate and install the new one, then reload the web server. With an ACME client such as certbot, check why automatic renewal did not run."
    }
  ],
  "checkedAt": "2026-11-15T18:24:09.801Z",
  "ms": 354,
  "expiresAt": "2015-04-12T23:59:59.000Z",
  "daysToExpiry": -4235,
  "issuedAt": "2015-04-09T00:00:00.000Z",
  "lifetimeDays": 4,
  "subject": "*.badssl.com",
  "issuer": "COMODO RSA Domain Validation Secure Server CA",
  "protocol": "TLSv1.2",
  "cipher": "ECDHE-RSA-AES128-GCM-SHA256",
  "alpn": "http/1.1",
  "authorizationError": "CERT_HAS_EXPIRED",
  "ocspStapled": false
}

Next step

Certificate searchWhich certificates were ever logged for it?
Check expired.badssl.com in Certificate search
Security headersGrade the headers it sends
Check expired.badssl.com in Security headers
Is it down?Does the site open from other countries?
Check expired.badssl.com in Is it down?

Why expiry checks matter more every year

An expired certificate turns a working site into a scary one in an instant. Browsers show a full-page warning, API clients refuse to connect and mail servers may drop deliveries. It is one of the most common and most avoidable outages. This page connects to the host, reads the certificate it serves and tells you the expiry date, the days left and the names the certificate covers.

Lifetimes are shrinking too. The CA/Browser Forum, where browsers and certificate authorities agree the rules, has decided that publicly trusted certificates may be valid for at most 200 days when issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Renewing by hand once a year is already off the table, and by 2029 a manual renewal would come round every few weeks.

How to check and track expiry

Check each public nameEnter every hostname that serves HTTPS, including www, API and mail hosts. A wildcard certificate may cover many of them, but each endpoint can serve a different certificate.
Read the days leftA healthy certificate reads “Valid and trusted” with the days remaining. At 30 days or fewer the headline turns into “Expires in 23 days” with a Renew soon label. Under 15 days usually means your renewal process is broken.
Set a reminder or automateAdd calendar reminders, and set up automatic renewal so you never depend on them.

Understanding the dates

The days left tell you what to do next. The ring on the result shows them against the certificate's whole lifetime, so a 90-day certificate with 10 days left looks nearly empty. The bands below suit 90-day certificates. As lifetimes shrink, scale them down, since renewal is usually due with about a third of the life left.

Days left	Status	What to do
More than 30	Healthy	Nothing, if automatic renewal is working.
15 to 30	Renewal due	Confirm the renewal job has run. Certificates issued by ACME clients (the tools that renew automatically) usually renew at about two-thirds of their life.
Under 15	Renewal failing	Investigate now: DNS or HTTP validation, rate limits, file permissions or a stopped service.
Expired	Visitors see a warning	Issue and install a new certificate straight away, then reload the server.

Intermediate and root expiry. Every certificate in the chain has its own dates, and the Chain tab lists them. A leaf with months left can still fail if an intermediate on the server has expired.
Several certificates behind one name. A load balancer may serve different certificates from different nodes. Check again if the date seems to change between attempts.
Not the domain expiry. The certificate and the domain registration are separate. Check the registration with the domain expiration checker.

Why renewals fail

Validation can't complete. HTTP validation needs port 80 open and the right path. DNS validation needs working API credentials for your DNS host.
Renewed but not reloaded. The new file exists, but the web server still serves the old one from memory. Add a reload hook to the renewal.
Hosting changed. A migrated site kept the old server's cron job, or none at all.
CAA blocks the CA. A new CAA record, or a switch of certificate authority without updating it, makes issuance fail. A CAA lookup shows which authorities are allowed.
Rate limits. Repeated failed attempts can trigger a certificate authority's limits. Fix the cause before you retry.
Forgotten endpoints. Staging sites, mail servers, VPN gateways and admin panels often have manual certificates that nobody tracks.

How the check works and the standards

LookupOwl performs a TLS handshake with the correct server name, reads the leaf certificate's validity period and subject alternative names, and counts the days remaining in UTC. Automatic issuance and renewal use the ACME protocol (RFC 8555). Validity rules are set by the CA/Browser Forum Baseline Requirements (ballot SC-081), and certificate fields are defined in RFC 5280. For the chain, key and protocol details, use the full SSL checker.

Shell

# The expiry date, from a terminal
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
# Exit code 0 if valid for at least 30 more days
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend $((30*86400))

Questions people ask

How do I check when my SSL certificate expires?

Enter the hostname above and read the days left. The page connects to the live server the way a browser would, so you see the certificate your visitors actually get. In a terminal, openssl x509 -noout -enddate gives the same date, and the openssl s_client command further down this page shows the full one-liner.

How long are SSL certificates valid now?

Public certificates issued from 15 March 2026 may last at most 200 days. Before that the limit was 398 days. It falls to 100 days on 15 March 2027 and to 47 days on 15 March 2029. Let's Encrypt has issued 90-day certificates for years and plans to shorten them further. Shorter lifetimes limit the damage from a stolen key and push everyone toward automatic renewal.

What happens when an SSL certificate expires?

Browsers show a full-page warning that most visitors won't click through, apps and APIs refuse the connection, and payment or login flows can fail. The site behind the warning is usually fine, which is why the outage is so avoidable. Installing a new certificate and reloading the server fixes it, often within minutes.

Can I renew a certificate early?

Yes, and automated clients do. Renewing at about two-thirds of the certificate's life leaves weeks to fix a failure before expiry. With automated certificates, renewing early costs nothing, and the new certificate takes over as soon as your server reloads. There is no reason to wait for the last week.

Why does the date differ from my CA dashboard?

The dashboard probably shows a newer certificate that hasn't been installed yet. This page shows what the live server is serving right now, which is what visitors get. If the dates differ, install the new certificate, reload the service and check again. If you run several servers, make sure each one has been updated.

Does a wildcard certificate expire sooner?

No. Wildcard certificates have the same maximum lifetime as any other public certificate. They matter more because one wildcard often covers many hosts, so a single expiry can take down several services at once. Check every endpoint that uses it, and set up one renewal job that reloads all of them.

Does the check include intermediate certificates?

The headline and the days left come from the certificate your visitors see first, called the leaf. The Chain tab lists when each certificate above it ends, so you can spot an intermediate that has expired or is about to. A chain is only as healthy as its weakest link, so look at every row.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is ssl_check. Please be kind to the rate limits.

curl

curl "https://lookupowl.com/api/v1/tools/ssl-checker?q=example.com"

MCP

claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt

Domain

DNS

Email

Network

IP and subnets

Web

Security

Make and convert

SSL certificate expiry checker

Results for expired.badssl.com

Expired 4235 days ago

Next step

Why expiry checks matter more every year

How to check and track expiry

Understanding the dates

Why renewals fail

How the check works and the standards

Questions people ask

Use it from AI, the API or the command line

Expired 4235 days ago

Next step

Why expiry checks matter more every year

How to check and track expiry

Understanding the dates

Why renewals fail

How the check works and the standards

Questions people ask

Use it from AI, the API or the command line

You might also need