SSL Certificate Expiry
Calculate the days remaining until an SSL/TLS certificate expires.
About SSL Certificate Expiry
SSL/TLS certificates have a fixed validity period. When they expire, browsers show security warnings and connections may fail. Planning renewal before expiry (with a buffer for processing time and potential issues) prevents outages. Most CAs now limit certificates to 90-398 days.
Formulas
Days remaining
days = expiry_date - today
- expiry_date
- Certificate's notAfter date
- today
- Current date
Renewal deadline
renew_by = expiry_date - buffer_days
- buffer_days
- Lead time needed for renewal process
Worked example
With the default values below, SSL Certificate Expiry returns Days Until Expiry of -302. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Expiry Yearaccepts 2,000–2,100
- 2,025
- Expiry Monthaccepts 1–12
- 12
- Expiry Dayaccepts 1–31
- 31
- Renewal Bufferminimum 0 days
- 30 days
Results
- Days Until Expiry
- -302
- Status
- EXPIRED
- Days Until Renewal Needed
- -332
- Renew By Date
- 2025-12-01
Step by step
- 1Expiry date= 2025-12-31
- 2Days remaining= -302 days
- 3Renewal deadline= 2025-12-01
- 4Days until renewal needed= -332 days
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
What happens when a certificate expires?
Browsers display a security warning (often blocking the page), automated API clients reject the connection, and search engines may penalize the site. Some services like Let's Encrypt auto-renew, but any failure in that process can still cause an outage.
How much buffer should I allow for renewal?
30 days is a common minimum — enough time to notice renewal failures, resolve domain validation issues, and propagate the new certificate across load balancers and CDN nodes. Critical production systems often use 60+ days.