Certificate Expiry Calculator
Calculate days remaining until an SSL/TLS certificate expires and renewal deadline.
About Certificate Expiry Calculator
TLS/SSL certificates carry a fixed validity window (notBefore/notAfter fields in the X.509 certificate), and days remaining is simply the difference between the expiry date and today. Alerting on a single 'expired/not expired' boolean is too late to act on — production monitoring typically layers a warning threshold (e.g. 30 days, enough time to procure/rotate a cert through change management) and a critical threshold (e.g. 7 days, requiring immediate action) so renewal work is scheduled well before an outage-causing expiry.
Formula
Days remaining
days_remaining = expiry_date − today
- E
- expiry date
- T
- today
Worked example
With the default values below, Certificate Expiry Calculator returns Days Remaining of 44. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Certificate Expiry Date
- 2026-09-15
- Evaluation Date (today)
- 2026-08-02
- Warning Threshold (days)minimum 1
- 30
- Critical Threshold (days)minimum 1
- 7
Results
- Days Remaining
- 44
- Alert Level
- OK
- Status
- 44 day(s) remain before expiry — no action needed yet.
- Already Expired?
- false
- Critical Threshold Reached?
- false
- Warning Threshold Reached?
- false
Step by step
- 1Values used
- 2Days remaining
- 3Days Remaining= 44
- 4Alert Level= OK
- 5Status= 44 day(s) remain before expiry — no action needed yet.
- 6Already Expired?= No
- 7Critical Threshold Reached?= No
- 8Warning Threshold Reached?= No
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How do I check a certificate's expiry date from the command line?
`openssl x509 -enddate -noout -in cert.pem` prints the notAfter date directly. For a live server, use `echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -enddate`.
Why do modern browsers cap maximum TLS certificate validity at around 398 days?
CA/Browser Forum baseline requirements (and enforcement by Apple's Safari/root program since 2020) limit publicly-trusted certificate lifetimes to reduce the exposure window if a certificate's private key is compromised or if it was issued to a domain that later changes ownership — shorter lifetimes force more frequent, safer re-validation.
What's the benefit of automating certificate renewal instead of tracking expiry manually?
Tools like `certbot` (Let's Encrypt ACME client) or cert-manager (Kubernetes) automatically renew certificates well before expiry and reload the serving process, eliminating the human error and forgotten-renewal risk that causes the majority of real-world expiry-related outages.