SSL Certificate Expiration Tracker

An SSL (Secure Sockets Layer) certificate is a digital credential that encrypts data between a visitor's browser and your server. Google has used HTTPS as a ranking signal since 2014 — sites without a valid certificate rank lower and trigger browser warnings that destroy user trust. A valid certificate is the minimum baseline for any site that appears in search results.

This tool does two things simultaneously: it queries the public Certificate Transparency logs via the Certspotter API to read your cert's exact issue date, expiry date, lifespan and revocation status — and it makes a live HTTPS request to your domain to verify the certificate is actually working and to read your security response headers (HSTS, X-Frame-Options, X-Content-Type-Options). No data is stored and the scan takes under two seconds.

The 90-day maximum is an industry standard pioneered by Let's Encrypt and adopted by major certificate authorities. Short lifespans limit the damage window if a private key is ever compromised, and they push site owners toward automated renewal (via Certbot or platform-managed certs) rather than manual processes that get forgotten. As of 2026, the CA/Browser Forum is actively discussing reducing the maximum validity period to 47 days.

All major browsers immediately block visitors with a full-screen error page — there is no soft warning. Organic search rankings drop quickly because Google's crawler treats the site as unreachable. Email delivery from the domain may also be affected. Renewal fixes it instantly once propagated, but the SEO damage from downtime can persist for days. This tool's 30-day amber warning exists specifically to give you time to renew without any downtime.

HTTP Strict Transport Security (HSTS) is a response header (Strict-Transport-Security) that tells browsers to always use HTTPS for your domain — even if someone types http:// or clicks an old HTTP link. Without it, a visitor's first HTTP request is vulnerable to a man-in-the-middle attack before the redirect to HTTPS happens. Once the browser has seen the HSTS header, it enforces HTTPS locally for the duration of max-age. Adding your domain to the HSTS Preload List hardcodes this policy into browsers before any visit.

Certificate Transparency is an open framework that requires every publicly trusted certificate to be logged in a public, append-only ledger before browsers will accept it. This means any certificate ever issued for your domain — including ones you didn't authorise — is publicly auditable. This checker queries those logs to show you how many active certificates exist for your domain and flags any that are revoked or unexpectedly issued. It's one of the only free tools to surface CT log history directly in the results.

A revoked certificate has been marked invalid by its issuing Certificate Authority before its normal expiry date. This happens when a private key is compromised, when the cert was mis-issued, or when the domain owner explicitly requests revocation. Browsers that perform revocation checks will reject a revoked cert the same way they reject an expired one. If this tool shows your cert as revoked, you need to request a new certificate from your CA immediately.

Yes — enter any subdomain directly (e.g. app.yoursite.com, www.yoursite.com). The CT log query uses wildcard matching so it will find certificates that cover your subdomain under a wildcard cert (e.g. *.yoursite.com) as well as dedicated certs. Non-standard ports are not supported in this free version.

Most modern hosting platforms handle renewal automatically: Cloudflare, Vercel, Netlify, Hostinger and similar services manage your certificate lifecycle with no action required. If you run your own server, install Certbot and set a cron job to run certbot renew twice daily — it only acts when renewal is due. Check this tool monthly to confirm the auto-renewal is actually firing.