SSL certificate checker.
When it expires, who issued it, and whether browsers trust it.

A certificate says which names a server may use, who vouches for it and until when. Browsers check all three on every connection.

Expires

The certificate's notAfter date. After it, browsers show a full-page warning and most API clients refuse to connect.

Issuer

The certificate authority that signed it, with the name of its intermediate, such as Let's Encrypt R12 or Google Trust Services WE2.

Covers

The names in the certificate (Subject Alternative Names). The host must be one of them, or match a wildcard like *.example.com, which covers one level only: www.example.com, not example.com or a.b.example.com.

Chain

Your certificate, the intermediate that signed it and the root your device trusts. The server has to send the intermediate; the root is already on the device.

TLS version

TLS 1.3 and 1.2 are current. 1.0 and 1.1 are switched off in every major browser.

Key

ECDSA P-256 is small and fast; RSA 2048 is the most common. Both are fine today.

The browsers and certificate authorities agreed in 2025 (CA/Browser Forum ballot SC-081) to cut the longest a public certificate may last, in steps:

Until 15 March 2026

398 days

From 15 March 2026

200 days

From 15 March 2027

100 days

From 15 March 2029

47 days

Let's Encrypt already issues 90-day certificates and is going further: 45 days for those who opt in since May 2026, 64 days by default from 10 February 2027 and 45 days from 16 February 2028. Its 6-day certificates are available on request.

The reason is that revoking a certificate doesn't work well: browsers rarely check. A short life limits how long a stolen key or a wrongly issued certificate stays useful, and makes sure the owner proves control of the domain often. It also means nobody can renew by hand any more: renewal has to be automated, and checked.

Let's Encrypt used to email a warning before a certificate expired. It stopped on 4 June 2025, so a renewal job that quietly fails is now only noticed when visitors see the warning page.

Automated clients renew when about a third of the lifetime is left: around 30 days before the end of a 90-day certificate. A certificate that is closer to its end than that usually means renewal has stopped.

Renew it and reload the server. With Let's Encrypt and certbot that is certbot renew followed by a reload of nginx, Apache or whatever serves the site; Caddy, Traefik and most hosting panels renew on their own and only fail when something blocks them.

When renewal fails, the usual causes are: the domain's DNS no longer points at this server, port 80 is closed so the HTTP challenge can't reach it, a DNS-challenge API token expired, or the server got a new certificate but was never reloaded. Run this check again afterwards: the expiry date should move.

If you see the old date after renewing, a CDN or load balancer in front of the server may hold its own certificate.

How do I check when an SSL certificate expires?

Type the host name in the box above. nmspc connects to it the way a browser does and shows the expiry date, days left, issuer, the names the certificate covers, whether the chain is complete, the TLS version and the key type. Free, no account needed.

Can I check a mail server's certificate?

Yes, on ports that start with TLS straight away: 465 (SMTP), 993 (IMAP) and 995 (POP3), as well as 443 and 8443. Ports that upgrade with STARTTLS, such as 587, 25 and 143, aren't supported.

Does Let's Encrypt still email me before my certificate expires?

No. Let's Encrypt stopped sending expiry emails on 4 June 2025. If renewal breaks, nothing tells you unless you have your own monitoring.

My browser says the site is fine, but this says the chain is incomplete. Who is right?

Both. Desktop browsers often fetch or remember the missing intermediate certificate, so the site looks fine to you. curl, apps, payment and webhook callers and some phones don't, and fail. Configure the server to send the full chain.

Does it check revocation?

No. It checks dates, names, the chain up to a trusted root and the connection. Browsers mostly don't check revocation live either, which is one reason certificates are getting shorter.