SSL Certificate Expiry Calculator
Count the days until an SSL/TLS certificate expires, flag when it enters the renewal window, and get the date you should renew by.
How it works
days until expiry = expiry date − today · renew-by date = expiry date − lead days
A TLS certificate stops being trusted the instant it expires, and browsers show a full-page security warning that blocks visitors — so the number that matters is simply how many days remain from today until the notAfter date. Subtracting a lead time gives a renew-by date that leaves room to reissue, validate and deploy before the deadline, ideally automatically. Since the CA/Browser Forum shortened maximum certificate lifetimes, manual renewal is increasingly impractical; the lead window here is a safety net, not a substitute for automation like ACME.
Worked example
If today is September 15, 2026 and the certificate expires on January 1, 2027, that is 108 days away. With a 30-day lead time, the renew-by date is December 2, 2026, and the status reads “Valid” until then.
Sources: Transport Layer Security — Wikipedia
Frequently asked questions
How many days before expiry should I renew?
A common practice is 30 days, which leaves time to reissue and deploy if something goes wrong. Automated systems like ACME/Let’s Encrypt typically renew at one-third of the lifetime remaining — around 30 days on a 90-day certificate.
What happens the moment a certificate expires?
Clients can no longer validate it, so browsers and API clients show or throw a certificate error and refuse the connection. To visitors the site appears broken and untrustworthy until a valid certificate is installed.
Why are certificate lifetimes getting shorter?
Shorter validity limits the damage window if a key is compromised and forces regular re-validation of domain control. The industry is moving toward certificates measured in weeks, which makes automated renewal essential.
Related calculators
This calculator is for educational purposes. Double-check important results before acting on them.