SSL & domain expiry checker
Check a site's SSL certificate (issuer, validity and when it expires) and its domain registration (registrar, nameservers and renewal date), so an expired cert or a lapsed domain never catches you out.
How it works
- We open a live TLS connection to the host (port 443 by default) and read the certificate the server actually presents: who issued it, the validity window, the hostnames it covers, and the negotiated protocol and cipher.
- Expired, self-signed and mismatched certificates are still read and reported rather than rejected, so you see exactly what is wrong instead of a bare failure.
- Domain details come from RDAP, the structured registry data that replaced WHOIS: registrar, registration and expiry dates, and nameservers. Some country-code TLDs publish little RDAP data, so that panel can be sparse for them.
- The check runs on demand and nothing is stored. It is a single standard connection, the same kind a browser makes when it visits the site.
What to do with the results
- Amber expiry (30 days or fewer): confirm your renewal automation is actually firing. Most modern certificates renew automatically, and a certificate drifting into the amber zone is often the first sign the automation broke months ago.
- Hostname mismatch: the certificate is real but does not cover the name you checked. Reissue it with the missing hostname in its subject alternative names, or fix the server so the right certificate is served for that name.
- Domain expiry approaching: check auto-renew is on at your registrar and that the payment card on file has not expired. A lapsed domain takes down the website and email together, and recovery can be slow and costly.
- All green: note the earlier of the two dates and make sure something other than memory will flag it. Expiries fail quietly, and the first symptom is usually a browser warning your visitors see before you do.
If this is a site you run, treat certificate and domain renewals as part of routine website protection: SiteGauge can watch the site continuously and alert you well before either date arrives.
Frequently asked questions
Enter the domain and the checker opens a live TLS connection to the server (port 443 unless you specify another), reads the certificate it presents, and reports the valid-from and valid-to dates with a countdown of days remaining. Anything inside 30 days shows amber, and an expired certificate shows red with how long ago it lapsed. Because the certificate is read straight off the server, the result reflects exactly what a visitor's browser is being shown right now.
A certificate lists the exact hostnames it protects: the common name plus the subject alternative names, including wildcards like *.example.com. If the domain you checked is not on that list, browsers show a security warning even though the certificate itself may be perfectly valid. Mismatches usually appear when a www and non-www variant are served from different setups, or when a site moves servers and inherits the wrong certificate. The fix is to reissue the certificate with the right names or serve the correct certificate for that hostname.
Yes. The checker completes the TLS handshake without rejecting untrusted certificates, so it can still read and report an expired, self-signed, or mismatched certificate instead of just failing. That is deliberate: when something is wrong you want to see the details, not only an error. The tool reports what it finds and never trusts, installs, or stores the certificate.
From RDAP, the structured successor to WHOIS that domain registries publish. The checker works out the registrable domain (so a check on shop.example.co.uk looks up example.co.uk) and reports the registrar, creation date, expiry date, last update, and nameservers. Some country-code TLDs publish little or no RDAP data, in which case the registration panel can be empty even though the SSL check still works.
An expired certificate makes browsers show a full-page security warning, which turns away most visitors instantly. An expired domain is worse: the website and email on it stop working, and recovering a lapsed domain can be slow and expensive, if it is possible at all. Most modern certificates (Let's Encrypt, for example) are valid for 90 days and renew automatically, so the real risk is silent automation failure. Check renewals are actually firing, keep registrar auto-renew on, and have something external alert you before either date arrives.