- Home
- Free tools
- SSL checker
SSL certificate checker
Check when an SSL certificate expires, who issued it and whether the chain is valid.
Checked from one Tenium region via the public check API. For the full chain, run openssl s_client -connect host:443 -servername host.
Get told 30 days before this certificate expiresAn SSL monitor in Tenium checks expiry, chain and hostname on a schedule and alerts at 30, 14 and 3 days. Included from Starter ($7 a month).
Start freeWhat the result shows, and what it leaves out
The tool asks Tenium's check service to open a TLS connection to port 443, read the certificate the server presents and fetch the page. You get the days remaining, the issuing organisation, the HTTPS status code and an approximate expiry date worked out from the day count, so it can be off by up to a day. The verdict line is about dates only. It does not validate the chain or the hostname on its own, so look at the HTTPS status cell as well: a certificate error shows up there as a message, even when the days-left figure looks healthy.
For the complete picture, run openssl s_client -connect host:443 -servername host from a terminal. That prints every certificate the server sends, in order, which is the evidence you need for chain problems.
Chain errors, in the words clients use
A browser may hide a broken chain, while an API client does not. These are the messages you will actually meet:
- "unable to verify the first certificate" or "unable to get local issuer certificate": the server sent its leaf but not the intermediate. Serve the full chain file (fullchain.pem), not cert.pem alone.
- CERT_HAS_EXPIRED or "certificate has expired": the date has passed. Renew first, then investigate why automation failed.
- ERR_TLS_CERT_ALTNAME_INVALID or "hostname mismatch": the certificate is valid but not for this name. A wildcard such as *.example.com covers www.example.com but not example.com itself and not a.b.example.com.
- "self-signed certificate": the issuer is the subject. Fine for internal tools, a failure for anything public.
Why old devices break when your laptop does not
On 30 September 2021 the DST Root CA X3 certificate that Let's Encrypt's older chain relied on expired. Sites that were perfectly configured began failing for clients with old trust stores, such as Android before 7.1.1 and OpenSSL 1.0.x, while current browsers carried on. The lesson generalises: the chain your server sends is only valid if the client has a root that anchors it. If a small group of users reports certificate warnings and you cannot reproduce them, ask for the device and operating system version before assuming the certificate is wrong.
Lifetimes keep shrinking
Let's Encrypt issues 90 day certificates and ACME clients normally renew when 30 days remain. Publicly trusted certificates in general are being capped lower in stages: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029, according to the industry rule the browsers agreed. Manual renewal stops being a workable plan when a certificate lasts a few weeks, and a silent automation failure becomes an outage in a matter of days. Count on an external check rather than on the renewal job reporting its own success.
Moving from checking to watching
An SSL monitor reads the certificate your visitors receive, checks the chain and the hostname, and sends alerts at 30, 14 and 3 days before expiry. It is part of the Starter plan ($7 a month) and above; the Free plan has no certificate monitoring. One thing the one-off tool cannot show is a certificate that differs between CDN edges or between the www and bare hostnames, so add each public name as its own monitor. The article what to do when a certificate has expired covers the emergency path.
Questions about this tool
How do I check when an SSL certificate expires?
Enter the hostname above and read the Days left value, or run echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates in a terminal, which prints the notBefore and notAfter dates.
Why does the tool show a valid certificate while my browser shows a warning?
The verdict summarises dates. The browser also checks that the chain is complete and that the name matches. A hostname mismatch or an untrusted issuer appears in the HTTPS status cell, and an openssl run shows the full chain.
What is a good time to renew a certificate?
With 90 day certificates, renew at about 60 days, leaving 30 days to fix failures. If you renew manually, make 30 days remaining the trigger. Any certificate with under 14 days left and auto-renewal supposedly on has a broken renewal.
Does it check intermediate certificates?
Not directly. It reports the leaf certificate's expiry and issuer. A missing intermediate usually surfaces as an error in the HTTPS status cell, but for the exact chain use openssl s_client with -showcerts.
Can it check ports other than 443 or an internal hostname?
No. It connects to the standard HTTPS port on public hostnames only. An SSL monitor in Tenium lets you choose another port for services that use TLS from the first byte.