What this check does
The tool connects to the domain on port 443, the same way a browser does, and reads the certificate the server presents. It reports:
- Valid from and expires: the certificate only works between these two dates.
- Days left: how long until browsers start showing a full-page warning.
- Issued by: the certificate authority that signed it.
- Names covered: the certificate only works for the names in this list.
*.example.comcovers one level of subdomain and notexample.comitself. - Trust: whether the chain leads to a trusted authority and the name matches.
Why certificates expire, and how often
An expiry date limits the damage if a certificate's private key is stolen, and it forces the owner to prove control of the domain again.
Lifetimes keep getting shorter. Let's Encrypt certificates last 90 days. Since 15 March 2026 a new public certificate from any authority can be valid for at most 200 days. The limit drops to 100 days in March 2027 and to 47 days in March 2029.
At those lifetimes, renewing by hand does not work. Renewal must be automatic, and something must check that the automation is still running.
What to do with the result
| Result | What to do |
|---|---|
| More than 30 days left | Nothing. Automatic renewal usually runs at 30 days. |
| Under 30 days and you use automatic renewal | The renewal has probably failed. Check its log today. |
| Under 14 days | Renew by hand now, then fix the automation. |
| Expired | Visitors see a warning page. Renew, install, and reload the web server. |
| Dates fine, not trusted | The name does not match, or the server is not sending the intermediate certificate. Install the full chain. |
A one-off check tells you about today. PULSX tracks the expiry date on every HTTPS monitor and alerts you before it runs out. It is free.