How to Check Whether Your Website’s SSL Certificate Is Valid or Expired

To check whether your website’s SSL certificate is valid, you need to confirm five things: it has not expired, it covers the exact domain name visitors type, it was issued by a certificate authority browsers trust, the server sends the full chain of intermediate certificates, and the connection uses a modern version of TLS. If any one fails, browsers show a full-page security warning and most visitors leave.

Clicking the padlock in your own browser shows only part of that picture, and only for the device you are using. An online SSL checker connects to your server from the outside, the way a new visitor would, and reports every item at once.

A note on terms: “SSL” is the name everyone still searches for, but the protocol websites actually use today is TLS. The certificates are the same thing, whichever name you use.

What “valid” actually means for a certificate

A certificate is a signed file that binds your domain name to a public key. A browser accepts it only when every link in a chain of trust holds:

1. Date range. Today’s date falls between the certificate’s “not before” and “not after” dates.
2. Name match. The domain in the address bar appears in the certificate’s Subject Alternative Name list, either exactly or via a wildcard such as *.example.com. A wildcard covers one level only, so it matches shop.example.com but not example.com itself or eu.shop.example.com.
3. Trusted issuer. The certificate traces back, through one or more intermediate certificates, to a root certificate already stored in the browser or operating system.
4. Complete chain. Your server sends the intermediates. Desktop browsers sometimes fill gaps from cache; many phones, apps and API clients do not.
5. Not revoked, and a sound protocol. The certificate has not been withdrawn by its issuer, and the server offers TLS 1.2 or 1.3 rather than obsolete versions.

Worked example: a sample SSL check, explained line by line

Below is a sample result for a fictional US accountancy firm’s site, www.example-cpa.com, checked on a day when the certificate still had a few weeks left to run.

Line 1 says the certificate is currently accepted. On its own, that is reassuring but incomplete, as the following lines show.

Line 2 is the urgent item. Twelve days is enough time to renew, but only just. If renewal is meant to be automatic and the certificate is this close to expiry, the automation has probably failed silently, often because a DNS record or a firewall rule changed. Find out why before you renew by hand, or the same thing will happen next cycle.

Line 3 confirms both the bare domain and the www version are listed. Missing one of these is a classic cause of warnings that appear for some visitors but not others.

Line 4 shows a client portal on a subdomain that the certificate does not cover. Anyone visiting it sees a name-mismatch error. The fix is either a separate certificate for that host or a reissued certificate that adds it to the SAN list.

Line 5 identifies a domain-validated certificate from a trusted authority. For browser trust, domain validation is as effective as the more expensive types; the difference is in what the authority verified about the organisation, not in the encryption.

Line 6 is the hidden failure. The server is sending only the site’s own certificate, without the intermediate that links it to a trusted root. Desktop Chrome may still show a padlock, which is why the owner never noticed, while some Android devices, payment integrations and email clients refuse the connection. Install the “full chain” or “fullchain” file your certificate authority provides instead of the single certificate file.

Line 7 shows TLS 1.0 still enabled. Modern browsers no longer use it, but leaving it switched on keeps an outdated, weaker option open. Disable TLS 1.0 and 1.1 in the server configuration and keep 1.2 and 1.3.

Line 8 confirms plain-HTTP visitors are sent to the secure version with a permanent redirect, which is what you want.

If you have command-line access, you can see the dates and issuer for yourself:

Check your own certificate now: type your domain into the free SSL certificate checker to see its expiry date, covered names, chain status and supported protocols, then compare each line with the explanations above.

Why certificates expire more often than they used to

Public certificates have a maximum lifetime set by industry rules agreed between certificate authorities and browser makers, and that lifetime has been getting steadily shorter, with further reductions already scheduled. Shorter lives limit the damage if a private key leaks, but they also mean manual renewal is no longer realistic for most organisations.

The practical answer is automation through the ACME protocol, which most hosting control panels and certificate authorities now support. Automation fails too, though, so pair it with monitoring: an alert at 30 days and again at 14 days before expiry gives you time to act without panic.

Errors you might see, and what each one means

• “Your connection is not private” with an expiry message: the certificate has passed its end date. Renew and reload the web server so it picks up the new file.
• Name mismatch: the address visited is not on the certificate. Common after adding a subdomain or moving a site to a new domain.
• Incomplete chain or unknown issuer: intermediates are missing or, occasionally, the certificate is self-signed.
• Padlock with a warning triangle: the certificate is fine but the page loads some images, scripts or stylesheets over plain HTTP. That is mixed content, which a website security checker will list alongside missing security headers.
• Error on some devices only: often an incomplete chain, or a device whose clock is wrong.

After renewing or moving a certificate, confirm that the HTTP-to-HTTPS redirects still behave. A redirect checker shows whether visitors reach the secure page in a single hop.

Frequently asked questions

How do I know when my SSL certificate expires?

Click the padlock in your browser and open the certificate details to see the “valid to” or “expires on” date. An SSL checker shows the same date along with the number of days remaining, and it tests from outside your network, so the result reflects what visitors see rather than a cached copy.

What happens if my SSL certificate expires?

Browsers display a full-page warning before anyone can reach your site, and many visitors will not click past it. Online forms, checkout pages, APIs and payment integrations that depend on the connection can stop working. Search engines may also struggle to crawl the site until a valid certificate is in place.

Is a free SSL certificate as secure as a paid one?

For encryption and browser trust, yes. Free domain-validated certificates use the same cryptography and display the same padlock. Paid options mainly add organisation validation, warranties, longer support arrangements or management tools. Choose based on those extras, not on any difference in the strength of the connection.

Why does my site show a padlock on my laptop but an error on my phone?

The most common cause is a missing intermediate certificate. Desktop browsers may have cached the intermediate from another site and quietly fill the gap, while mobile devices and apps are stricter. Install the full chain file on your server and test again from an external checker.

An expired or misconfigured certificate is one of the few website problems that can block every visitor at once, yet it is entirely preventable with a quick check and a calendar alert. Make the check part of your monthly routine with the TechBullion SSL checker, and test again any time you add a subdomain, change hosting or renew.