Cert Expiry Checker

An expired TLS certificate doesn't just show a scary warning page — for API integrations, webhooks and mobile apps it usually means a hard failure with no user-facing warning at all, just silently broken traffic until someone notices revenue or data stopped flowing. Certificate lifetimes have gotten shorter over the years (90 days is now the industry norm for many issuers, down from years), which means renewal has to be a routine, automated event rather than something a person remembers to do — and automation quietly fails more often than anyone likes to admit: a cron job that stops running, a renewal hook that silently errors, a load balancer that never picked up the new cert from disk.

This tool connects to your domain the same way a real client would — a genuine TLS handshake, not a WHOIS-style lookup — and reads the actual certificate the server presents. You get the exact expiry date, how many days remain, and who issued it. Fewer than 30 days remaining is flagged as a warning; fewer than 7, or already expired, is flagged critical.

If you're using an automated issuer like Let's Encrypt, a healthy setup renews around day 60 of a 90-day certificate — so seeing 20-30 days remaining once in a while during the renewal window is normal. Seeing it every time you check, or seeing single-digit days, means the automation isn't actually running and you're one missed cron job away from an outage.

Continuous monitoring (checking this daily rather than whenever you remember to) is what catches a broken renewal pipeline while there's still time to fix it manually — that's what the paid plans add on top of this free one-off check.

Want the full picture? Run the complete certificate health check