How to Check Certificate Expiry for a Website
A practical guide to checking certificate expiry, understanding why renewal timing can still go wrong, and knowing what to verify before users start seeing trust warnings.
Certificate expiry checks sound simple because, in one sense, they are.
Every publicly served certificate has an expiry date.
The problem is that “certificate renewed” and “users are definitely seeing the renewed certificate” are not always the same thing.
The quick way to check certificate expiry
Use Domain Lookup and inspect the certificate details first.
You want to know:
- issuer
- validity
- expiry date
That gives you the fast outside-in answer.
Why expiry checks still matter
A lot of certificate incidents do not come from some exotic TLS bug.
They come from very ordinary failures:
- renewal did not happen
- renewal happened, but the new certificate was not deployed
- one edge still serves an older certificate
- the wrong hostname was checked
That is why expiry checks are still worth doing even on “fully automated” setups.
What to ask after you find the expiry date
Not just “when does it expire?”
Also:
- is that the certificate real users are actually getting?
- is the hostname correct?
- is the full chain being served properly?
Those extra checks are what stop expiry checks from becoming false reassurance.
A sensible certificate-expiry workflow
- check the publicly served certificate
- note the expiry date
- confirm the hostname matches
- confirm the chain looks healthy
- verify the renewed certificate is the one currently being served
That sequence is much better than checking an internal file and assuming the public path matches it.
Why “it was renewed” is not enough
People often stop too early here.
A certificate can be renewed in the automation flow while:
- the server was not reloaded
- the edge has not picked up the new cert
- the wrong cert bundle is still configured
That is why outside-in checking matters.
Useful follow-ups
- How to Check an SSL Certificate for a Website
- Why Browser Still Shows Old Certificate After Renewal
- How to Monitor Certificate Expiration and Renewal Failures
The short version
A certificate expiry checker is useful, but only if you are checking the certificate that users actually receive.
That is the difference between real expiry monitoring and a false sense of safety.
Continue reading
Stay in the same investigation track with these closely related guides.
Tools mentioned in this article
Run the same diagnostics to follow along with the guide.