Certificate Expiry Calculator
Calculate days remaining until a TLS/SSL certificate expires and check alert thresholds.
Inputs
Days Remaining
44
Alert Level
OK
Status
44 day(s) remain before expiry — no action needed yet.
Already Expired?
false
Critical Threshold Reached?
false
Warning Threshold Reached?
false
Step by step
Values used
Certificate Expiry Date = 2026-09-15; Evaluation Date (today) = 2026-08-02; Warning Threshold (days) = 30; Critical Threshold (days) = 7
Days remaining
days_remaining = expiry_date − today
Days Remaining
= 44
Alert Level
= OK
Status
= 44 day(s) remain before expiry — no action needed yet.
Already Expired?
= No
Critical Threshold Reached?
= No
Warning Threshold Reached?
= No
How it works
TLS/SSL certificates carry a fixed validity window (notBefore/notAfter fields in the X.509 certificate), and days remaining is simply the difference between the expiry date and today. Alerting on a single 'expired/not expired' boolean is too late to act on — production monitoring typically layers a warning threshold (e.g. 30 days, enough time to procure/rotate a cert through change management) and a critical threshold (e.g. 7 days, requiring immediate action) so renewal work is scheduled well before an outage-causing expiry.
Formula
Days remaining
days_remaining = expiry_date − today
- E
- expiry date
- T
- today
Frequently Asked Questions
How do I check a certificate's expiry date from the command line?
`openssl x509 -enddate -noout -in cert.pem` prints the notAfter date directly. For a live server, use `echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -enddate`.
Why do modern browsers cap maximum TLS certificate validity at around 398 days?
CA/Browser Forum baseline requirements (and enforcement by Apple's Safari/root program since 2020) limit publicly-trusted certificate lifetimes to reduce the exposure window if a certificate's private key is compromised or if it was issued to a domain that later changes ownership — shorter lifetimes force more frequent, safer re-validation.
What's the benefit of automating certificate renewal instead of tracking expiry manually?
Tools like `certbot` (Let's Encrypt ACME client) or cert-manager (Kubernetes) automatically renew certificates well before expiry and reload the serving process, eliminating the human error and forgotten-renewal risk that causes the majority of real-world expiry-related outages.