SSL RENEWAL & WEBSITE AVAILABILITY
How to Check SSL Certificate Expiration
TLS certificates have a limited validity period so website identity and key use must be reviewed over time. When a certificate expires, browsers may show warnings and applications or API clients may reject the connection—even if the web server is still running.
For a business website, that can interrupt secure access, unsettle visitors, and interfere with purchases or other HTTPS-dependent services. This guide explains how to check the expiration date, investigate renewal failures, and verify the certificate actually served to clients.
The fastest ways to check
Use a public SSL checker for the exact hostname, open your browser’s certificate viewer, or read the served certificate with OpenSSL. Review the expiration date alongside hostname coverage and chain validation. For managed or proxied websites, check each relevant TLS endpoint rather than assuming one result covers the entire system.
What Is an SSL Certificate Expiration Date?
Not Before: when validity begins
The Not Before value marks the start of the certificate’s validity period. A certificate installed before that time may be rejected as not yet valid. An incorrect client clock can produce the same apparent date problem.
Not After: when validity ends
The Not After value defines the end of the validity period. Clients checking the certificate after that time should reject it. Certificate viewers may display local time, while tools commonly display UTC or GMT; compare the actual instant rather than the displayed calendar date alone.
There is no universal lifetime for every certificate. Public browser and certificate-authority requirements change, and private or specialized certificates follow different policies. Read the dates on the certificate currently presented and follow the issuer’s renewal guidance instead of assuming a fixed annual cycle.
An unexpired certificate can still fail
Expiration is only one part of TLS validation. The requested hostname must be covered, the chain must validate to an appropriate trusted authority, and other client requirements may apply. A valid date does not prove a website is free from malware or other risks.
Check SSL Expiration Online
Hostingcone’s free SSL Certificate Checker inspects the publicly presented certificate for a hostname. Use the exact name visitors access, including www or a specific subdomain where relevant.
1. Enter the domain or hostname.
2. Run the certificate check.
3. Read the expiration date.
4. Check the reported days remaining.
5. Review the issuer and hostname coverage.
6. Investigate any trust or validation errors.
Check SSL Certificate Expiration for Free
The checker labels 30 days or fewer remaining as expiring soon. That is a tool warning threshold, not a universal renewal deadline. Expiration and hostname or chain failures need separate attention; certificate metadata labelled untrusted is not a successful validation.
The check samples one public address on port 443 from the Hostingcone server and uses its trust store. Other addresses, regions, and browser trust stores may differ. For a proxied Cloudflare hostname, the result commonly describes the edge certificate. A connection failure does not establish that a certificate is expired.
How to Check Certificate Expiration in Your Browser
Open the exact HTTPS hostname. Where certificate information is available, look for the validity period and compare the requested name with the certificate’s Subject Alternative Names. Browser labels and control locations change between versions.
Google Chrome
Use the site controls beside the address bar to open connection/security details, then certificate information if offered. Inspect the validity dates, issuer, and covered names. On a warning page, use the available details without proceeding to an unsafe page; if a viewer is unavailable, use an external checker or ask the owner.
Microsoft Edge
Open the browser’s site information or security controls beside the address bar and inspect the certificate where your version provides that option. Compare the validity period with the correct device time. Managed-device policies can affect what certificate is presented and which authorities are trusted.
Mozilla Firefox
Use the site information/security interface near the address bar, then the connection details or certificate viewer offered by your release. Review the certificate’s validity dates and hostname coverage. The certificate seen on an inspected corporate network may differ from the public website’s certificate.
Safari
On macOS, use connection or certificate details where Safari offers them, including warning details when appropriate. Safari on iPhone or iPad may not expose the same viewer as desktop versions; use the online checker or contact the provider if the date is not shown. Do not install unknown profiles or permanently trust an unfamiliar certificate.
A browser inspects the certificate for its current connection. It does not necessarily check every load-balanced node or the origin behind a reverse proxy. Recording the hostname, issuer, expiration, and time of your test helps compare results.
Check SSL Expiration Using OpenSSL
OpenSSL must be installed and available in your shell. The following examples use a POSIX-compatible shell on macOS or Linux; Windows shell redirection has different syntax. Replace every occurrence of example.com with the exact hostname, without a URL scheme or path.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates-connect selects the host and port. -servername supplies Server Name Indication (SNI), which helps shared hosting and proxies select the certificate for that hostname. Without SNI, a server may return its default certificate instead of the one visitors receive.
openssl x509 extracts the certificate and prints notBefore and notAfter. Read their timezone information. The redirections close input and hide s_client diagnostics to keep the date output concise; use an unsuppressed diagnostic command when investigating failures.
To also read the reported issuer and subject, use:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -subject -datesReading dates does not verify trust
The date pipeline can extract an expired or untrusted certificate. It does not establish successful hostname or chain verification, and it does not check every endpoint or revocation condition. An empty result may mean a connection or parsing failure rather than an expired certificate.
For a separate diagnostic that requests hostname verification and stops on certificate verification errors, keep the verification output visible:
openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com -verify_return_error </dev/nullInterpret this result using your OpenSSL version and configured CA store. A CA-store problem on the test machine can differ from a browser’s result. These commands are manual checks and do not create ongoing expiration monitoring.
How to Check SSL Expiration on Windows
For most website owners, use Chrome, Edge, or another browser’s certificate information. If the viewer is unavailable, a publicly functional online checker can inspect the exact hostname without server access.
Check the served certificate with Hostingcone’s SSL Checker
OpenSSL is not guaranteed to be installed on Windows. If you have it, use its supported commands in the appropriate shell. The previous /dev/null example requires a POSIX-compatible shell; do not paste that redirection unchanged into Command Prompt or PowerShell.
If your administrator or hosting panel provides a public certificate file, Windows PowerShell can inspect its dates with Get-PfxCertificate. This example uses a public .cer file, not a private-key archive:
Get-PfxCertificate -FilePath .\certificate.cer | Select-Object Subject, Issuer, NotBefore, NotAfterThis reads the local file only. It does not fetch the website’s certificate, establish trust, or prove that the web server has activated that file. Compare it with the certificate presented by the live hostname. Dates may be displayed in the computer’s local time zone.
Check Windows date, time, time zone, and synchronization when a date warning affects only one device. Correct the actual clock; do not shift it to make an expired certificate appear valid. Follow administrator guidance on managed computers.
What Happens When an SSL Certificate Expires?
Browsers can display certificate warnings and refuse normal secure access. API clients, mobile apps, payment integrations, and other TLS-validating software may also reject the connection. Different clients can show different error wording or retries.
That interruption can make visitors hesitate, abandon a form, or leave before completing a purchase. The practical effect depends on the service and its clients; a certificate expiry does not automatically switch off every hosting service or prove that all traffic is affected.
The web server can remain online while valid HTTPS access fails from a client’s perspective. Renew and deploy the correct certificate, verify hostname coverage and the chain, and retest the affected endpoint. Do not ask customers to bypass warnings or disable verification.
Troubleshoot “Your Connection Is Not Private” in Chrome, Edge, and Safari
Why SSL Certificate Renewal Fails
Separate the stages: issuance obtains the replacement, installation puts it in the correct environment, and activation makes the TLS endpoint serve it. Diagnose the failed stage before retrying renewal.
1. Automatic Renewal Is Disabled
Confirm that renewal is enabled for the certificate and that the relevant scheduler, hosting automation, or service is running. A certificate installed once does not necessarily have a renewal process attached.
2. Domain Ownership Validation Fails
Review the issuer’s validation error and the challenge type in use. Domain-control checks must succeed at renewal when required; changed DNS, domain status, authorization, or CAA restrictions can affect issuance.
3. DNS Validation Records Are Missing or Incorrect
For DNS-based challenges, check the required TXT record at the exact validation name, the active authoritative zone, any delegation, and the automation’s DNS permissions. A record added to an inactive DNS provider will not satisfy public validation.
4. HTTP Validation Endpoints Are Inaccessible
For HTTP-based challenges such as HTTP-01, the authority must reach the required challenge response, normally through port 80. Check the validation path, routing, and supported redirect behavior rather than assuming an arbitrary website page proves the challenge works.
5. The Domain Points to the Wrong Server
Check both A and AAAA records and each relevant hostname. The challenge can reach an old or different server after a migration or DNS change. Correct the intended routing without disrupting unrelated services.
6. A Firewall or Proxy Interferes
Access controls, WAF rules, redirects, or a proxy can block or alter challenge requests. Follow the certificate provider’s validation guidance and make a targeted correction; avoid broadly disabling security controls.
7. ACME Client Configuration Errors
Review renewal logs for account, challenge, DNS integration, file permission, scheduler, or deployment-hook errors. Follow the client’s supported testing process. Avoid repeated production issuance attempts that could encounter CA rate limits.
8. The New Certificate Has Not Been Installed
Issuance creates a new certificate, but the hosting platform or deployment process still needs to install it with the appropriate key and chain. Successful issuance is not proof that visitors receive the replacement.
9. The Server Is Still Presenting the Old Certificate
Check certificate selection for the hostname, the supported reload/deployment step, load-balancer nodes, and IPv4/IPv6 endpoints. One node may still use an old file or virtual-host configuration. Compare the served certificate rather than the certificate listed in an order or control panel.
How to Prevent SSL Certificate Expiration
Enable supported automatic renewal and document who owns it. Keep the domain and authoritative DNS configuration current, maintain necessary DNS API permissions securely, and review ACME or hosting-platform renewal logs when appropriate.
Monitor the certificates actually served, not only files or renewal orders. Choose alert thresholds that leave time to investigate validation, deployment, or vendor issues. A 30-day warning is a useful example for some workflows, but shorter-lived certificates and specific renewal systems may need different thresholds.
After renewal or a configuration change, test externally and compare the new expiration with the expected certificate. Check relevant subdomains, IPv4 and IPv6 destinations, and load-balanced nodes. For a proxied website, monitor edge and origin certificates separately.
A practical renewal checklist
Confirm renewal scheduling; inspect the latest renewal result; verify installation and activation; check the certificate served to clients; test relevant hostname coverage and chain validation; and route alerts to someone who can respond. Automation and monitoring reduce risk but do not guarantee uninterrupted HTTPS access.
Cloudflare and SSL Certificate Expiration
For a proxied website, visitors negotiate TLS with Cloudflare’s edge, while Cloudflare connects separately to the origin. These connections can use different certificates with different issuers and expiration dates. A valid edge result says nothing conclusive about the origin’s current certificate.
Full (strict) requires an appropriate origin certificate whose dates and hostname validate. It can use a publicly trusted certificate or a suitable Cloudflare Origin CA certificate. Origin CA certificates are designed for the Cloudflare-to-origin connection; ordinary browsers do not generally trust them when visiting the origin directly.
An external checker querying a proxied hostname commonly sees the edge certificate rather than the origin. Inspect origin certificate status through the hosting platform or an authorized origin diagnostic, retaining correct SNI and hostname validation. Do not expose an origin or change proxy/DNS settings simply to get a different lookup result.
Review edge certificate activation and renewal independently from origin renewal and deployment. Cloudflare’s Universal SSL is not proof of a valid origin certificate. Do not use Flexible SSL or weaken verification as a general workaround for an expired or invalid origin certificate.
When to Renew or Replace Your Certificate
Act before expiration with enough time to resolve the issuer’s validation and deployment requirements. If automated renewal is failing, investigate promptly instead of waiting for the final day. Follow your certificate product’s renewal process; this guide does not prescribe a universal renewal window.
Domain or hostname changes may require reissuance with different Subject Alternative Names. A migration may require installation on a new endpoint, renewal, or reissuance depending on the certificate and key-handling policy. Review the provider’s guidance rather than assuming an existing certificate automatically transfers.
Revocation or suspected private-key compromise requires an appropriate replacement and security response. Incorrect installation may need a certificate assignment or chain correction. Extending a date alone will not fix missing hostname coverage or an untrusted issuer.
Hostingcone SSL Services
Explore Hostingcone’s existing SSL certificate options for your website. Review the current product information and requirements on the service page; certificate issuance, installation, and ongoing management depend on the service selected.
Explore Hostingcone SSL Certificates
For ongoing website maintenance or help investigating configuration issues, explore Website Care and Website Repair. The scope depends on the purchased plan or work agreed, and third-party hosting, DNS, proxies, or software may affect the result.
Frequently Asked Questions
How do I check when an SSL certificate expires?
Use a browser certificate viewer, a publicly functional SSL checker, or OpenSSL to read the certificate served for the exact hostname. Review Not After and its timezone, along with hostname and chain validation.
What happens if my SSL certificate expires?
Clients validating TLS can show warnings or reject the connection, interrupting normal secure access. The server may still be online, and unrelated hosting services do not automatically shut down.
Can an SSL certificate renew automatically?
Yes, when supported and correctly configured by the provider or an ACME client. Validation, scheduling, installation, and activation can still fail, so verify the certificate actually served after renewal.
Why is my website still showing an expired certificate after renewal?
The new certificate may not have been installed, selected for the hostname, or activated. A load-balancer node, IPv6 destination, old DNS target, or different TLS endpoint may still present the old certificate.
How early should I renew an SSL certificate?
Allow enough time for validation, deployment, and troubleshooting, following the issuer’s process and the certificate’s lifetime. There is no universal renewal deadline; choose monitoring thresholds appropriate to your workflow.
Can I check SSL expiration without server access?
Yes. A browser or public checker can inspect a publicly presented certificate without logging into the server. The result samples that connection and may not reveal a private origin behind a proxy.
Does Cloudflare hide my origin certificate?
For a proxied hostname, an ordinary external TLS check normally connects to Cloudflare’s edge and sees its certificate. The origin certificate is separate and must be checked through an appropriate authorized origin or hosting diagnostic.
Is SSL expiration the same as domain expiration?
No. A TLS certificate and a domain registration have separate lifecycles. Domain expiration can affect DNS, access, or certificate validation, but renewing a domain does not automatically renew or deploy its TLS certificate.
Can an expired certificate affect email or API connections?
Yes, if the affected service uses TLS and the client validates the expired certificate. Website HTTPS on port 443 is only one endpoint; mail services and other APIs may use different hosts, ports, and certificates.
Don't Let an Expired Certificate Disrupt Your Website
Check your website's SSL certificate details, review expiration dates, and explore Hostingcone's SSL solutions or website troubleshooting services.
Explore Website Care for ongoing website maintenance and support
Find more certificate troubleshooting guides in Hostingcone’s SSL Troubleshooting Hub.