Check when your SSL certificate expires, and whether renewal is working
To check your HTTPS certificate's expiry, click the icon next to your site's address in the browser and open the certificate details, or run openssl s_client against your domain. Certificates now last weeks to months and renew automatically, so the real question is whether renewal is running: a certificate with only a few weeks left and no newer one issued usually means renewal has stalled.
Read the expiry date
In the browser: open the site information next to the address bar, find the certificate details, and read the expiry ("valid until") date. The exact labels differ between browsers.
From a terminal:
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null \
| openssl x509 -noout -enddate -issuer
It prints the end date (notAfter=) and the issuer.
How long certificates last now
- Let's Encrypt: "Our default certificates are valid for 90 days," with an opt-in six-day option. It recommends "renewing 90 day certificates every 60 days."
- Every public certificate authority is moving to shorter lifetimes. Under CA/Browser Forum Ballot SC081v3 the maximum is 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029.
Short lifetimes are only safe with automatic renewal, which is why a stalled renewal is the thing to watch.
If renewal has stalled
Many hosts issue and renew certificates for you. Netlify, for example: "Certificates are generated and renewed automatically as needed." When automatic renewal stops, look at these first:
- DNS no longer points at the host. Certificate authorities check that the domain points where the request comes from. Check your A/CNAME records match the host's instructions.
- A CAA record blocks the authority. A CAA record that lists only another certificate authority makes the next renewal fail.
- A custom certificate you uploaded yourself. Netlify: for custom certificates "Renewal is not automatic." Switch to the host-managed certificate.
- A proxy or redirect blocks the validation request (for example a rule that intercepts
/.well-known/acme-challenge/).
Check the domain's status in your host's dashboard; it usually shows the certificate state and the last error.
What Pewterkit Check looks at
For an app on its own domain, the check reads the public Certificate Transparency logs for the certificates that cover your host name and takes the one that runs the longest. It reports a fix when even that certificate ends within 21 days, meaning no newer one has been issued, and a warning from 25 days, the point where automatic renewal is normally done (thresholds shrink in proportion for certificates that last less than 90 days). When the logs can't be reached, the check stays silent rather than guess. A related check looks at whether your CAA records allow the authority that issues your certificate.
FAQ
How early should a certificate renew?
Let's Encrypt recommends renewing 90-day certificates every 60 days, about 30 days before they end.
Do I have to renew my certificate myself?
Where your host manages the certificate, renewal runs on its own; Netlify says its certificates are "renewed automatically as needed." A certificate you bought and uploaded yourself is the one you renew by hand.
What do visitors see when it expires?
A full-page browser warning before your site loads. Most people leave at that point.
Sources
- FAQ: certificate lifetime and renewal (Let's Encrypt) — read 27 Oct 2026
- Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods (CA/Browser Forum) — read 27 Oct 2026: ballot passed, reductions from March 2026 to 47 days by March 2029
- SSL certificate validity changes 2026–2029 (DNSimple) — read 27 Oct 2026: the dated 200, 100 and 47 day steps
- HTTPS (SSL) (Netlify Docs) — read 27 Oct 2026
- openssl-s_client (OpenSSL documentation)
How this page was made: drafted with AI from the sources listed, reviewed by Pewterkit. Docs checked Oct 27, 2026. Spotted something out of date? Tell us.