SSL Certificate Expiry: 6 Real Examples, Clearly Solved

SSL certificate expiry sounds like a date you read once and forget, yet it takes sites offline every week. The date itself is easy. The part that bites is turning it into days left, a renewal plan and an alert schedule. This guide solves six realistic cases with the numbers shown.

What the checker reads before we count SSL certificate expiry

Every certificate carries two dates: not before and not after. RFC 5280 defines both. The span between them is the validity period. The checker reads these from public Certificate Transparency logs through crt.sh, so it shows the newest logged certificate for a domain and does not open a live connection to your server.

That distinction matters for the examples below. If you renewed a few minutes ago, the log may lag. For the exact certificate a server presents right now, the command line is the authority.

Read live SSL certificate expiry dates from a terminal

Copyecho | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Example 1: Days left on four certificates

Suppose today is 13 October 2026. You check four domains and write down the not after date for each. Subtract today from that date and apply the bands: expired is red, 14 days or fewer is critical, 30 days or fewer is amber, anything above is green.

Look at api.example. Nine days sounds like plenty, yet renewal can stall on domain validation, a purchase approval or a freeze on production changes. SSL certificate expiry warnings give you less slack than they appear to, so treat the amber band as the real deadline and the critical band as an emergency.

Example 2: A 90 day certificate and its renewal day

Free automated authorities issue certificates valid for 90 days and recommend renewing every 60. Take one issued on 15 September 2026. Add 90 days and the not after date is 14 December 2026.

The checker spots this pattern. A 90 day span with an issuer such as R3 or E1 means automation should handle it, so an expiry in three weeks is expected, not alarming. What you watch for is the renewal job failing silently.

Example 3: A 200 day certificate

Commercial certificates last longer, though not as long as they once did. A certificate issued on 2 June 2026 and valid until 19 December 2026 has a validity period of 200 days. Check it on 13 October.

The progress bar in the result card shows exactly this share. At 66.5 percent you have time, but a manual renewal that needs a purchase order and a change window should start now.

Why validity windows keep shrinking

Browser makers and certificate authorities agreed a schedule that cuts the maximum lifetime in steps. Reported dates are 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. The earlier limit was 398 days. Treat these as the current plan and confirm the latest rules with your provider, since they can change.

What this means is simple. Manual renewal stops being practical. Anyone still pasting certificates by hand needs automation before the 100 day step arrives.

Example 4: Which hostnames the certificate covers

A valid date does not help if the name is wrong. The checker lists the Subject Alternative Names, which is the list browsers match against. Say the SAN list holds example.com, a wildcard for any name one level below example.com, and shop.example.org.

Example 5: Build an alert calendar from the date

Take a certificate whose SSL certificate expiry date is 20 January 2027. Today is 13 October 2026, so 99 days remain. Work backwards from the expiry to place four alerts, so nobody depends on memory.

Put these in a shared calendar, not a personal one. A reminder that lives with a person who has left the team is how most surprise outages begin. Also record who owns each date. An alert that reaches five people and belongs to none of them gets ignored by all five, while a named owner with a backup gets the job done in an hour.

Example 6: Valid dates, but the chain is broken

A site shows 80 days left and a matching name, and still fails for some visitors. The server sends only its own certificate and leaves out the intermediate that links it to a trusted root. Desktop browsers often recover because they cached the intermediate from another site. Mobile apps, API clients and payment gateways often cannot.

The fix is to install the full chain file your authority provides, then test from a clean client such as a phone on mobile data. Expiry checks alone will never find this problem, because it reads logged certificate data and does not test what a server actually sends. For that, use openssl or a test from a real client.

A routine for tracking SSL certificate expiry

Certificates are one of several things worth checking together, and a calm routine beats a heroic rescue every time. Review your response headers for HSTS, confirm your DNS records point where you expect, and read how DNS propagation affects validation after a move.

• HTTP Header Checker
• DNS Lookup Tool
• Date Difference Calculator

Frequently asked questions

Sources: Certificate lifetimes and renewal advice, FAQ from a free automated certificate authority · RFC 5280: Internet X.509 Public Key Infrastructure Certificate Profile