{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ badge.label }}{{ badge.value }}
Use a neutral public target such as example.com. No request is made until you select Check expiry.

{{ runStatus }}

Use 443 for ordinary HTTPS or an integer from 1 to 65,535.
Leave blank to use the checked hostname; enter a DNS name only for an intentional virtual-host override.
Choose the internal planning window before the certificate's Not After timestamp.
Use 1,000–15,000 milliseconds.
ms

{{ briefTitle }}

{{ briefDetail }}
{{ computation.values.coverage_label }}
This report reads one served leaf certificate. It does not validate the trust chain, revocation status, or every deployment edge.
FieldObserved valueUseCopy
{{ row.field }}{{ row.value }}{{ row.use }}
PriorityActionEvidenceCopy
{{ row.priority }}{{ row.action }}{{ row.evidence }}

{{ chartError }}

Certificate Signing Request (CSR) Generator Generate a PKCS#10 RSA CSR and matching private key in your browser, with SAN review and optional encrypted PKCS#8 key export.
SSL Checker Check a public hostname across SSL Labs endpoints for weak protocols and trust gaps, then prioritize certificate renewal and TLS fixes.
SSL Certificate Chain Checker Check a live TLS host or pasted PEM chain for broken issuer links, hostname and expiry problems, then build a root-aware install bundle.
SSL OCSP Checker Check a public TLS host or pasted certificate for OCSP status and responder timing with freshness warnings and independent-verification evidence.

Certificate renewal is complete only when the intended listener serves the new certificate. A certificate authority dashboard can show a successful issuance while a load balancer, reverse proxy, alternate port, or stale deployment edge still presents the old leaf certificate. Monitoring the live endpoint catches that gap before clients reach an expiry failure.

An X.509 certificate has a validity interval. Not Before is the first timestamp at which it is valid, and Not After is the end of that interval. Days remaining are useful for planning, but the exact UTC timestamp matters near the boundary. “One day left” does not guarantee a full 24-hour work window.

Renewal lead time is an operating policy, not a property of the certificate. A 30-day lead means the work should start 30 days before Not After, leaving time for issuance, validation, staged deployment, rollback, and verification. Shorter-lived certificates can be renewed automatically, but automation still needs enough margin to survive account, DNS, rate-limit, or deployment failures.

Leaf certificate
The endpoint certificate presented for the requested service, before any issuing certificates in the chain.
Subject Alternative Name
The SAN entries that identify the DNS names or IP addresses the certificate covers.
Server Name Indication
SNI, the hostname sent during the TLS handshake so a shared listener can choose the intended certificate.

Name coverage and expiry answer different questions. A certificate may be valid for months yet omit the requested hostname. Modern service identity uses SAN entries; a matching Common Name alone is not a substitute when SANs are present. A wildcard such as *.example.com covers one left-most label, such as api.example.com, but not v2.api.example.com.

One successful check is not complete fleet evidence. Content delivery networks, anycast services, regional load balancers, and blue-green deployments can serve different certificates from different edges. The checked listener proves what one network path presented at one time.

Expiry monitoring should therefore combine a live-listener check with renewal records, deployment verification, and trust-path monitoring. A future Not After date alone does not validate the certificate chain, revocation status, application protocol, or every production edge.

How to Use This Tool:

Check the same hostname, port, and SNI choice that real clients use.

  1. Enter a public Host or URL. The hostname is extracted from an HTTPS URL or host-and-port form.
  2. Set Listener port to 443 for ordinary HTTPS, or use the actual TLS port from 1 to 65,535.
  3. Leave SNI override blank to send the checked hostname. Enter a different DNS name only when deliberately testing a virtual-host mapping.
  4. Choose the Renewal lead time used by the operating policy, then set a connection timeout from 1,000 to 15,000 milliseconds.
  5. Select Check expiry. If DNS, TCP, or TLS fails, verify the public hostname, listener, firewall path, and SNI choice before interpreting the certificate data.
  6. Read the renewal stage and Name coverage, then compare the serial number, Not After value, and fingerprints with the deployment record.

Interpreting Results:

Healthy runway means the certificate is outside the selected lead window. Lead window open means the action-by date has passed. Final week means the certificate has not expired and 0 to 7 displayed days remain. Expired means the checked time is later than Not After, even when the rounded day count is still zero.

  • Use the exact Not After and action-by timestamps for scheduling; the day count is rounded upward.
  • Treat SAN match as the relevant hostname result. A Common Name-only result calls for reissuance with an explicit SAN.
  • A new serial number, fingerprint, and later Not After value are useful deployment evidence after renewal.
  • Do not read a successful result as chain validation. The probe deliberately collects the served leaf certificate even when normal certificate verification would fail.
  • Recheck from other required regions or edges when the service has distributed TLS termination.

Technical Details:

The live probe resolves the public hostname, opens a TCP connection to the selected port, sends SNI, and completes enough of the TLS handshake to read the peer’s leaf certificate. It records the protocol, cipher, subject, issuer, SAN entries, serial number, validity timestamps, and SHA-256 and SHA-512 fingerprints.

Formula Core:

Days remaining are the ceiling of the millisecond difference between Not After and the explicit check time, divided by 86,400,000 milliseconds per day.

Dremaining = ⌈ TnotAfter−Tchecked 86400000 ⌉

The action-by timestamp subtracts the selected lead time from Not After.

Taction = TnotAfter − ( Dlead × 86400000 )

For example, a Not After value 29.2 days after the check rounds to 30 displayed days. With a 30-day lead, the action-by timestamp has already passed even though the displayed certificate lifetime is still 30 days.

Renewal Rule Core:

Stage Boundary Planning meaning
Expired Checked time is later than Not After. Replace the served certificate immediately.
Final week Not expired, with 0 <= days remaining <= 7. Issuance and deployment are immediate work.
Lead window open 7 < days remaining <= selected lead The planned renewal start has been reached.
Healthy runway days remaining > selected lead Schedule work by the calculated action date.

Name Coverage Rule Core:

Presented identity Coverage result
Exact SAN equals the checked hostname SAN match
Wildcard SAN matches exactly one left-most DNS label Wildcard SAN match
Common Name matches and no SAN entries are present CN only; reissue with an explicit SAN
Common Name matches but a non-matching SAN list is present SAN mismatch
No SAN entry matches Name mismatch

Wildcard matching does not apply to IP literals and does not cross more than one label. SAN names are normalized to lowercase and trailing dots are removed for comparison. Up to 200 returned SAN entries are retained in the report.

Privacy and Accuracy Notes:

The hostname, port, SNI choice, and timeout are sent to a server-side certificate probe, which connects to the public listener and returns certificate evidence. Do not use the checker for private names or endpoints whose existence should not be disclosed to that service.

  • Only one served leaf certificate is read. Trust-chain validation, revocation, Certificate Transparency, OCSP, and application behavior are outside the result.
  • The probe’s network location may reach a different CDN or anycast edge from a user or monitoring region.
  • A connection error can come from DNS, routing, firewall policy, timeout, SNI, or TLS negotiation; it does not by itself prove certificate expiry.
  • Certificate responses are marked not to be cached, but ordinary infrastructure logging policies may still apply to the request.

References: