Blog/
SSL certificate expiry: how to check before it breaks your site
Why TLS certificates expire, how to read issuer and SAN fields, and how to check days remaining with a free SSL checker.
Browsers only trust HTTPS when the server presents a valid TLS certificate. Certificates expire on purpose — short lifetimes limit damage if a private key leaks. Let’s Encrypt and many CAs now issue 90-day certs by default.
What to verify
- NotBefore / NotAfter dates and days remaining.
- Subject Alternative Names (SAN) cover your hostname (and www if needed).
- Issuer matches a trusted CA your visitors accept.
- Chain is complete — missing intermediates cause mobile failures.
Issuer, SAN, expiry, and days left — no paid API.
Automate renewals
Use ACME clients (certbot, Caddy, Traefik) or your host’s auto-SSL. Calendar reminders alone fail under load. Pair renewal with a weekly check of production hostnames so a silent failure shows up before users do.
Security headers still matter
A valid cert is the baseline. HSTS tells browsers to stay on HTTPS; CSP and frame options reduce XSS and clickjacking risk. After TLS is healthy, review response headers.