On this page
When does my SSL certificate expire?
The SSL checker reads your site's certificate the way a browser receives it and gives the expiry date and the days left. It checks your address with and without www, because a certificate that only covers one of them shows a warning to anyone who types the other. It follows http to https and reads the HSTS header a browser remembers. For vbsmarketing.eu on 25 October 2026 it found a certificate from Amazon, valid until 8 February 2027, 106 days left, for both names.
That date matters more than it used to. A certificate could last 398 days until March 2026; now it is 200, from 15 March 2027 it is 100 and from 2029 just 47. Renewing a yearly certificate by hand turns into four renewals a year, then eight.
Four times shorter in three years
How long a certificate may last
until 15 March 2026
398 days
1 renewal a year
from 15 March 2027
100 days
4 renewals a year
from 15 March 2029
47 days
8 renewals a year
A certificate from Let's Encrypt, Amazon or Cloudflare renews itself. Anyone still buying a yearly certificate from their host and installing it by hand has to automate.
What the checker looks at
| Part | What is right | What a visitor sees when it is wrong |
|---|---|---|
| Expiry | more than 30 days left, or renewed automatically | a full-page warning that makes many visitors turn back |
| Name | the certificate covers your address with and without www | a warning that the site pretends to be another |
| Trust | issued by a recognised authority, with the full chain | a warning, often only on some phones or browsers |
| Redirect | http goes to https in one step | a page without the padlock, or a detour that costs load time |
| HSTS | max-age of at least a year | no error, but a first visit may still go over http |
| Lifetime | within the maximum on its issue date | a certificate browsers will refuse from that date |
An untrusted certificate is usually a missing intermediate certificate. A laptop may still accept the site because the browser already knows the intermediate, while phones do not. How the chain works is explained under SSL certificate.
Multilingual sites on several domains
A company that runs its site on a .be, a .eu and a .com, or on a domain per country, has a certificate per domain, and each can expire on a different day. Run the checker once per domain and note the dates; better still, let them all renew automatically from the same place. Pick one main address per language and redirect the others in a single step, which also keeps search engines from seeing two copies; the SEO checker shows how Google reads each page.
Why certificates are getting shorter
The CA/Browser Forum, where certificate authorities and the makers of Chrome, Safari, Firefox and Edge set the rules together, voted in April 2025 for shorter lifetimes. A certificate that leaks or was issued wrongly stays usable for less time, and short lifetimes force automation, so a replaced key reaches every server quickly.
| Issued from | Maximum lifetime | Domain validation reuse |
|---|---|---|
| Before 15 March 2026 | 398 days | 398 days |
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |
Let's Encrypt goes faster still: 45-day certificates as an option since May 2026, 64 days as the default from February 2027 and 45 days from February 2028. It also stopped sending expiry reminder emails in June 2025, so a failed renewal now goes unnoticed unless you watch for it yourself.
Ready for 100-day certificates
- Check who issues your certificateLet's Encrypt, Amazon, Google or Cloudflare renew by themselves. A yearly certificate you bought and installed does not.
- Turn on automatic renewalWith most hosts a free certificate with automatic renewal is a setting. On your own server an ACME client does the work.
- Add your own expiry checkWithout reminder emails from Let's Encrypt, a check that warns you when expiry gets close catches a renewal that failed.
- Check www, redirect and HSTSBoth names in the certificate, http to https in one step, and HSTS for a year once everything works.
What it costs, and what the checker does not see
A certificate every browser trusts costs nothing any more: Let's Encrypt, Amazon and Cloudflare issue them free, with automatic renewal. A paid certificate with your company name in it shows the same padlock. What you pay for is looking after it, together with hosting, updates and DNS.
A valid certificate does not make a site secure. Outdated plugins, weak passwords and an unpatched server are not visible here; for WordPress, read is WordPress safe. Mixed content, an image or script over http on an https page, needs a browser to spot. Your email is a separate matter: whether your domain has SPF, DKIM and DMARC shows in the DMARC checker. Moving your domain? Read how to transfer a domain name first, because a certificate does not always move with it.
SSL certificate questions
How do I check my SSL certificate?
Type your address into the checker. You see the issuer, the expiry date, whether the name matches with and without www, and whether http redirects to https. In a browser, click the padlock next to the address for the same details.
How long is an SSL certificate valid?
A certificate issued since 15 March 2026 lasts at most 200 days. From 15 March 2027 the limit is 100 days, and from 15 March 2029 it is 47 days.
What happens when my SSL certificate expires?
Browsers show a full-page warning instead of your site. Many visitors turn back, and forms and payments stop working until a new certificate is in place.
Why does my site work with www but not without?
Usually only the www name is in your certificate, or the bare domain does not answer on https. The checker lists the names your certificate covers.