Free tool
Is this SSL certificate valid, and when does it expire?
The expiry date, the issuer, every name the certificate covers and the state of its chain. We check the bare domain first, then www if the domain does not answer.
What visitors see the day it expires
Not a small icon. A full-screen red warning your visitor has to click past on purpose to reach the site, and on mobile most of them just leave. Forms, payments and any API pointing at the site stop working at the same moment, without warning.
Auto-renewal is not enough
Let's Encrypt renews itself — right up until it doesn't. Change an IP address, tighten a firewall rule, move a config file, and the renewal fails without a sound. Nobody finds out until expiry day, because nothing tells them.
The chain of trust
The browser does not trust you, it trusts a root
Your certificate is worth nothing on its own. It is worth whatever signed it, which is worth whatever signed that, all the way up to a root authority the browser already holds. Pick what your server sends and watch the bridge hold — or come up short.
Sent by your server
- example.comYour certificate
- Intermediate authorityMissing link
Already in the browser
Root authorities installed with the system
The bridge does not hold everywhere
Nothing links your certificate to a known root. Some browsers cope, fetching the intermediate themselves or pulling it from cache. Others do not. This is the fault behind the most familiar complaint in the trade: it works on my machine, not on my phone.
A browser never validates a certificate on presentation alone. It climbs the chain to a root that arrived with the operating system, not with the connection.
What the visitor sees
The browser does not argue.
Expired certificate, mismatched name, incomplete chain — the page never opens. A red screen stands in the way, your site sits behind it, and nobody gets through.
Reading the result
Four things get checked at once: the end date, the issuer, the names covered, and the chain. A certificate can be perfectly current and still break for your visitors.
- All clear — more than 30 days
- Valid certificate, complete chain, and it covers the name you asked about.
- Worth watching — 30 days or fewer
- If renewal is automatic, the certificate should swap itself out around now. This is the window where you find out whether it did.
- Problem — 7 days or fewer
- Once the date passes, every visitor hits a full-screen warning and every API call to the site fails.
- Problem — certificate expired
- The warning is already up. Most mobile visitors back out rather than click through it.
- Problem — self-signed certificate
- No recognized authority signed it — it signed itself, and no browser will trust that. A free certificate fixes it.
- Problem — the name is not covered
- The certificate does not carry the name you asked about. The browser warns anyway, however healthy the certificate is otherwise.
- Worth watching — incomplete chain
- The server leaves out the intermediate that links the certificate to its authority. Browsers usually track it down themselves. Mail clients and mobile apps often do not.
- Worth watching — only www answers
- Nothing answered on the bare domain. Type the address without www and you get nothing.
- Unknown — nothing answers over HTTPS
- No server answered on port 443, on the domain or on its www form. Either the site lives somewhere else, or it is not on HTTPS.
- Unknown — unreadable date
- The certificate came back, but its end date will not parse. Rare, and almost always a hand-built certificate.
The mistakes we see most often
Auto-renewal failed quietly
What causes it: Let's Encrypt checks that you control the domain before it reissues. Add a redirect, tighten a firewall rule, break the /.well-known/acme-challenge/ path, and that check fails without printing a thing.
What fixes it: read the ACME client log, then run a dry-run renewal so the error surfaces before the deadline rather than after.
The certificate covers the domain but not www
What causes it: it was issued for one name. Anyone who types the other form gets the full-screen warning.
What fixes it: reissue with both names on the same certificate. A redirect will not save you — the encrypted connection happens first, and the redirect is only read afterwards.
The intermediate chain is not served
What causes it: the server sends the leaf certificate on its own. Chrome and Firefox usually fetch the missing intermediate for you, which is exactly why it looks fine from your desk.
What fixes it: point the server at the full-chain file, not the certificate on its own.
The certificate is renewed, the service is not reloaded
What causes it: the new file is on disk. The process serving HTTPS is still holding the old one in memory, and load balancers never re-read the file by themselves.
What fixes it: wire the service reload into the ACME client's deploy step (--deploy-hook with certbot).
The machine's clock is wrong
What causes it: a certificate is judged against dates. A clock that has drifted will reject a good certificate, or wave through a dead one.
What fixes it: check time sync on the machine. The browser throws the same ERR_CERT_DATE_INVALID it would for a genuinely expired certificate.
Certificate errors shown by the browser
When a visitor hits the red screen, a code sits at the bottom of it. That code names the fault, and the fault is not always an expired date.
| Code | What it means | What causes it |
|---|---|---|
| ERR_CERT_DATE_INVALID | The certificate is not yet valid, or has expired, according to the browser's clock. | A missed renewal — or a wrong clock on the visitor's machine. |
| ERR_CERT_AUTHORITY_INVALID | The certificate is signed by an authority the browser does not trust. | Self-signed certificate, in-house authority, or a missing intermediate chain. |
| ERR_CERT_COMMON_NAME_INVALID | The name the certificate carries does not match the name requested. | Certificate issued for the bare domain and visited on www, or the other way around. |
| ERR_CERT_REVOKED | The certificate has been revoked by the authority that issued it. | Private key compromised, or revocation requested after a leak. |
| ERR_CERT_WEAK_SIGNATURE_ALGORITHM | The certificate is signed with an algorithm considered too weak. | An old certificate, or an in-house authority that was never updated. |
| ERR_CERT_WEAK_KEY | The certificate's key is too short to be accepted. | An RSA key generated years ago and carried through every renewal since. |
| ERR_CERT_NAME_CONSTRAINT_VIOLATION | The certificate claims names its authority is not allowed to cover. | An intermediate authority restricted to one specific domain by its issuer. |
| ERR_CERT_VALIDITY_TOO_LONG | The validity period is longer than the browser accepts. | A certificate issued for several years, usually by an in-house authority. |
| ERR_CERT_UNABLE_TO_CHECK_REVOCATION | The browser could not find out whether the certificate has been revoked. | The authority's checking service was unreachable when the visitor arrived. |
| ERR_CERTIFICATE_TRANSPARENCY_REQUIRED | The certificate does not carry the proof of publication required for this connection. | A certificate issued outside public channels, or by an authority that does not log. |
Codes taken from Chromium's error list: identical in Chrome, Edge, Brave and Opera, prefixed with NET:: on the warning page. Firefox names the same cases differently (SEC_ERROR_UNKNOWN_ISSUER, SEC_ERROR_EXPIRED_CERTIFICATE).
Common questions
How do I check if an SSL certificate is valid?
Type the domain above. The tool opens an encrypted connection to the site, reads whatever certificate comes back, and reports the end date, the issuer, the names covered and the state of the chain. It tries the bare domain first, then the www form if nothing answers.
How long does an SSL certificate last?
Depends who issued it. Let's Encrypt hands out ninety-day certificates and recommends renewing on day sixty. Paid authorities go longer, but the maximum anyone is allowed to issue keeps shrinking year after year. The tool reports the end date of the certificate actually in place.
What happens when an SSL certificate expires?
They get a full-screen warning they have to deliberately click through, not a small icon. Forms, payments and any API call aimed at that address stop working at the same moment, and the server reports no explicit error.
Do I need an SSL certificate for both www and non-www?
Both names need covering, on one certificate or on two. The encrypted connection is set up before any redirect is read, so pointing www at the bare domain does not let www off from carrying its own valid certificate.
Is a free SSL certificate as good as a paid one?
For encryption, yes. A Let's Encrypt certificate and a paid domain-validated one protect the connection identically, and the browser cannot tell them apart. What you pay for is a longer lifetime, someone to call, and with extended validation an identity check that browsers stopped displaying in 2019.
Why does the browser show an error when my certificate is valid?
Three causes cover nearly every case. The certificate does not cover the name typed. The intermediate chain is not served. Or the service was never reloaded and is still handing out the old file. The code on the warning screen tells them apart.
A certificate's calendar
Ninety days, and a thirty-day window.
A certificate does not last a year. Renewal is scheduled well before the end, and that gap is where you find out it stopped running.
90d
Validity at Let's Encrypt
That is the lifetime of the free certificates almost everyone runs. Paid authorities issue for longer, though the trend everywhere is towards shorter ones.
60th d
The recommended renewal
Let's Encrypt recommends renewing on day sixty, thirty days before the end. The margin is there to absorb a failed attempt — but someone still has to check whether it got used.
7d
This check's red threshold
This check turns amber at thirty days and red at seven. If auto-renewal is doing its job, you should never see amber.
The Let's Encrypt lifetimes are the ones the authority publishes, repeated in the FAQ on this page. The thirty- and seven-day thresholds belong to this check.
When the padlock drops
What to look at, in order
The browser already names the cause. Read it before you touch the configuration — and test both names, not one.
Read the code, not the message
ERR_CERT_DATE_INVALID and ERR_CERT_AUTHORITY_INVALID are not the same problem. One is a missed renewal. The other is an incomplete chain, or an authority nobody trusts. The code sits at the bottom of the warning screen.Try both names
The domain and www are two different addresses. A certificate issued for one does not cover the other, and that is exactly what ERR_CERT_COMMON_NAME_INVALID means.Check the chain, not the certificate
A valid certificate served without its intermediate works on your machine and fails on someone else's. Desktop browsers sometimes fill in the chain themselves. A phone or a mail client will not.Run a dry renewal
When renewal is automatic, the only way to know it still runs is to trigger it early and read the log. A silent failure leaves no other trace.