SSL certificate checker: when does the certificate expire?
Enter a web address. Beamfar opens one secure connection to it from this server and shows the certificate it gets: who issued it, who it is for, when it expires and how many days are left.
What the check reads
www.birch.example
- Issued to
www.birch.exampleFine - Issued by
Let's Encrypt (R11)Note - Valid until
14 Jan 2027Fine - Days left
73Fine - Protocol
TLS 1.3, ECDSA keyNote
What the check looks at
The same probes Beamfar uses to monitor a client site, run once, from this server.
- Does it answer?
- The page’s status and the time of the name lookup, the connection, the secure handshake and the first byte.
- Issued by
- The certificate authority that signed the certificate, for example Let’s Encrypt or a commercial authority.
- Issued to
- The name the certificate is for. A browser warns when it does not cover the address in the address bar.
- Valid until and days left
- The expiry date of the certificate and the whole days left, counted from now.
- Protocol and key
- The TLS version the server agreed on and the kind of key the certificate carries.
How to read the result
Each reading gets one of the words of the free check, with its mark.
Fine means the connection was secured with a certificate this server trusts, for this name, with more than a month left.
Look at this means it still works, but the certificate expires soon or something deserves a second look. Most certificates today live 90 days or less and renew automatically; a renewal that stopped shows up here as a falling number of days.
Problem means a browser would show visitors a full-page warning: the certificate expired, is for another name, or is not trusted.
Common certificate problems and what fixes them
- Expired
- renew it at the host or the certificate authority. When it was meant to renew by itself (ACME, Let’s Encrypt), the renewal job or the DNS check behind it failed: look there first.
- Wrong name
- the certificate covers
example.combut notwww.example.com(or the other way round). Add the missing name to the certificate, or redirect the name it does not cover. - Not trusted
- the server does not send the intermediate certificate, or the certificate is self-signed. Install the full chain the authority gave you.
- Renewed but still old
- the new certificate was issued but the server or the CDN still sends the old one. Reload or redeploy where the certificate is installed.
What happens to the address you enter
One check, then nothing kept. Only public websites, only the standard web ports.
- Nothing is stored
- The address is used for this one check and then forgotten: no database row, no log line, no cookie, no link to share the result. Only rate-limit counters are kept: hashed counts per network range and overall, for at most two days, never an address of a site.
- Only public websites
- Addresses on private networks, loopback, link-local and cloud-metadata ranges are refused, and so are redirects to them. Only the standard web ports 80 and 443 are used. Each name is looked up once and the connection goes only to the address that passed. Checks are limited per network and overall, share the budget of the free site check, and need a short puzzle to be solved by your browser.
The site you check will see one or two requests from Beamfar-probe in its logs, from this server. A monitor reads the certificate every day and warns you weeks before it expires; that is what Beamfar does for every client site.
Questions
Is this SSL checker free?
Yes. There is no account and no payment. It shares the rate limits of the free site check so that it stays available for everyone.
Does it check the certificate from more than one place?
No. It is one reading from this server. A certificate is the same everywhere in most cases, but a CDN can send different ones in different regions.
How many days before expiry should a certificate be renewed?
Most authorities renew 30 days before expiry. When fewer than 14 days are left and nothing renewed it, the automatic renewal is probably broken.
Does it check revocation?
No. The check reads the certificate the server sends and whether this server trusts it. It does not ask the authority whether the certificate was revoked.
Is the address I enter stored?
No. It is used for this one check only. Only hashed rate-limit counters are kept, per network range and overall, for at most two days.
Guides that go with this page
Longer reads on the same ground, in plain words, each with its sources.
- SSL certificate expiry on client sitesWhy certificates still expire, what shorter lifetimes change and a routine that catches expiry early.
- Redirect chains after a site migrationHow chains and loops appear after a migration, how Google treats each status code and how to repair them.
- Website down: a first-15-minutes triage checklistA step-by-step triage for a site-down alert: confirm it, find the broken layer and decide what to tell the client.
More free tools
One live check each, no account. The free site check runs all of them at once.
- Domain expiry checkerWhen a domain name’s registration ends, from the registry’s public RDAP record.
- Indexability checkernoindex in the robots meta tag or X-Robots-Tag, robots.txt blocks, the canonical and redirects.
- DNS lookupThe address, alias, name server and mail records of a name, from public resolvers.
- Security headers checkerHSTS, Content-Security-Policy, nosniff, frame protection, Referrer-Policy and more.
- The free site checkEvery check at once: the page, redirects, certificate, DNS, search settings and the domain registration date.
Get the warning weeks before it expires.
Beamfar reads every client site’s certificate and tells you before it expires, and when it was replaced.
No card for the trial.