How to Check an SSL Certificate: Expiry, Issuer & Grade

An expired SSL certificate instantly breaks your site for every visitor. Chrome shows a full-screen "Your connection is not private" warning, and most users bounce within seconds. In this guide we'll show you exactly how to check any website's SSL certificate in under 10 seconds, and what to do if it's about to expire.

What to check about an SSL certificate

A full SSL certificate check covers six things:

Expiry date — when the cert stops being valid
Issuer — which certificate authority (CA) signed it: Let's Encrypt, Sectigo, DigiCert, etc.
Covered domains (SANs) — every hostname the cert is valid for
Wildcard status — whether it covers all subdomains of a domain
HTTPS serving status — is HTTPS actually responding on port 443?
Chain validity — does the cert chain back to a trusted root?

The fastest way to check SSL: use a browser tool

Our free SSL Certificate Checker does all six checks in one request. You enter a domain, click Check, and get an A-F security grade in about 2 seconds.

For example, to check github.com's SSL, just visit trafficlens.io/ssl-checker/github.com. The page auto-runs the scan and shows issuer, expiry, and every covered subdomain.

When should you start worrying about expiry?

Our grading scale tells you exactly how urgent a renewal is:

Grade A — More than 90 days left. Nothing to do.
Grade B — 30-90 days. Renewal should be on the calendar.
Grade C — 7-30 days. Renew this week.
Grade D — Less than 7 days. Renew right now, today.
Grade F — Expired, or HTTPS isn't serving. Site is broken for visitors.

Let's Encrypt and auto-renewal

If your certificate was issued by Let's Encrypt, it's only valid for 90 days. That sounds scary, but every Let's Encrypt cert is auto-renewed by Certbot, Caddy, acme.sh, or your hosting platform (Vercel, Netlify, Cloudflare Pages, Fly.io, etc. all handle this transparently). You never need to manually renew.

If you see a Let's Encrypt cert with 30 days left, that's fine — it'll be auto-renewed before it expires. If you're concerned, check again in a week; you should see a fresh cert with 90 days.

What to do if your cert is about to expire

If renewal hasn't happened automatically:

Check your hosting platform — Vercel, Cloudflare, Netlify, Fly.io all auto-renew. Usually there's an admin panel showing cert status.
Check Certbot logs — if you self-host with Let's Encrypt, run sudo certbot renew --dry-run to see if renewal works.
Check DNS — HTTP-01 challenges require port 80 open; DNS-01 challenges require the domain's nameservers to be reachable. Our DNS Lookup tool can verify your nameservers are responding.
Check HTTP redirects — some HTTP-01 challenges fail if port 80 redirects to HTTPS. Use our Redirect Chain Checker to see the redirect chain.

Monitoring competitors' SSL (without their permission)

All SSL certificates are publicly logged in Certificate Transparency (CT) logs since 2018. You can check any domain's cert without authorization — and you can even monitor when a competitor rotates their cert, which may signal a CDN migration or security incident. Just enter any domain into our SSL Checker to pull the current cert from CT logs.

Try it now: Check any website's SSL certificate for free on Traffic Lens