When an SSL certificate expires, visitors to your website see a full-page browser warning telling them the connection is not private. Most people will leave rather than click through. Online forms, payment pages and anything else that relies on a secure connection can stop working properly.
The fix is usually simple, but only if you know the expiry date is coming. This guide shows you how to find it, and explains why it matters more than it used to.
A quick note on names: "SSL certificate" is the term most people use. The technology in use today is TLS, which replaced SSL, but the certificates are the same thing. We use both terms here.
Method 1: Check in your web browser
This is the quickest way for most people.
- Visit your website using
https://. - Click the icon to the left of the address bar. In Chrome and Edge this is a "site information" icon; in Firefox and Safari it is a padlock.
- Choose the option that says the connection is secure, then look for "Certificate is valid" or "View certificate".
- Find the field labelled Expires on, Valid to or Not After. That is your expiry date.
While you are there, note the Issued by field. It tells you which certificate authority issued your certificate, which is useful when you need to find out who renews it.
Method 2: Check from the command line
If you or your IT provider are comfortable with a terminal, OpenSSL can show the expiry date directly. Replace the domain with your own:
echo | openssl s_client -connect yourdomain.co.uk:443 -servername yourdomain.co.uk 2>/dev/null | openssl x509 -noout -enddateThe result looks like notAfter=Mar 1 12:00:00 2027 GMT. This method is handy for checking several addresses quickly, such as www, your main domain and any subdomains. Only run it against domains you own or are authorised to check.
Method 3: Check with your hosting provider or certificate supplier
Your hosting control panel, website platform or certificate supplier will usually list your certificates and their expiry dates. This is also where you find out whether renewal is automatic. If it is, check that the automation is actually working; a renewal that silently fails is a common cause of expired certificates.
Why this matters more from 2026
Certificate lifetimes are getting shorter. The CA/Browser Forum, the industry body that sets the rules for publicly trusted certificates, adopted Ballot SC-081 in 2025. It sets out a schedule for reducing the maximum validity of a TLS certificate:
| Certificates issued | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| From 15 March 2026 | 200 days |
| From 15 March 2027 | 100 days |
| From 15 March 2029 | 47 days |
In practice, this means that any certificate issued since 15 March 2026 lasts no more than about six and a half months. If you used to renew once a year, you will now renew at least twice a year, and from 2029 roughly every six weeks. Manual renewal becomes harder to keep up with, and automated renewal becomes the sensible default.
Some certificate authorities already issue short-lived certificates. Let's Encrypt certificates, for example, have typically been valid for 90 days and are designed to be renewed automatically. Let's Encrypt also stopped sending expiry reminder emails on 4 June 2025, so if you relied on those emails as a safety net, it is no longer there.
What to check besides the date
Knowing the expiry date is the first step. While you are looking, it is worth confirming:
- Every hostname is covered. Your certificate should cover both
yourdomain.co.ukandwww.yourdomain.co.ukif you use both, plus any other addresses such as a booking or client portal subdomain. - The certificate matches the site. A mismatch triggers the same browser warning as an expired certificate.
- HTTP redirects to HTTPS. Visitors who type your address without
https://should be sent to the secure version automatically. - Who is responsible for renewal. If your website was built by an agency or a former colleague, make sure someone still has access to the account that renews the certificate.
Making expiry a non-event
A few habits make certificate expiry much less likely to catch you out:
- Use automatic renewal where your provider supports it, and check it works after each renewal.
- Put renewal dates in a shared calendar, not one person's inbox, with a reminder at least 30 days before.
- Keep a simple list of every domain and subdomain you run, who hosts it and who renews its certificate.
- Use monitoring that checks your certificates on a regular schedule and shows in its report when expiry is approaching or a renewal has not happened.
Summary
You can find your SSL certificate's expiry date in under a minute using your browser. With maximum certificate lifetimes now at 200 days and falling to 47 days by 2029, renewal is becoming a regular task rather than an annual one. The safest approach is automated renewal, backed up by an independent check that tells you if something has gone wrong.
Haj Tech's free one-off security check reports your certificate's expiry date, issuer and whether it is valid for your website's address, along with your HTTPS set-up, security headers, email records and domain registration. Request one for a domain you are authorised to have checked at hajtech.uk.
Sources
- CA/Browser Forum, Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods
- CA/Browser Forum, Baseline Requirements (current version)
- Let's Encrypt, Ending Support for Expiration Notification Emails (22 January 2025)
- Let's Encrypt, Expiration emails documentation
- NCSC, Using TLS to protect data
- OpenSSL, s_client documentation
Want to know where your own website, email and domain stand? Request a free, no-obligation external security check for a domain you own or are authorised to have checked.
Request a free security check