SSL & Domain Expiry Checker
Both expiry dates in a single check: days left on the certificate, and the date the domain registration lapses. Free, no signup.
Two dates decide whether a site stays reachable, and they are kept in different places. This tool reads both from one hostname: the SSL certificate expiry, taken from a live TLS connection to the server, and the domain registration expiry, taken from the registry record. One check, both clocks, with the issuing authority and days remaining next to them.
Most tools answer half the question. Certificate checkers ignore the registration, whois lookups ignore the certificate, and the team ends up tracking whichever one broke last. Checking them together takes the same few seconds and tells you which deadline is actually the nearer one.
Seeing a certificate warning in the browser? Look it up in our list of common SSL errors and their fixes, or read the guide on why SSL and domain expiry matters.
Two clocks, two providers, one outage
The certificate and the domain are bought from different companies on different schedules. A Certificate Authority issues the certificate that encrypts the connection. A registrar holds the registration that makes the name resolve at all. Neither provider knows about the other, and neither will warn you about the other’s date.
The certificate clock is short and usually automated. Let’s Encrypt issues for 90 days and ACME clients renew at around 30 days remaining, so nobody thinks about it until the automation stops. A moved webroot, a revoked API token, a cron job on a server that got rebuilt. It had worked for two years, which is precisely why no one was watching.
The domain clock is long and usually manual. Registrations run a year at a time, auto-renew sits behind a card somebody added three jobs ago, and the reminder goes to an alias nobody reads. The failure is almost never a decision to let the name go. It is a declined payment.
They fail independently and both fail completely. A valid certificate does nothing for an expired domain; a renewed domain does nothing for an expired certificate. Most teams monitor one of the two, and the outage arrives from the other.
| SSL certificate | Domain registration | |
|---|---|---|
| Provider | Certificate Authority | Registrar |
| Typical term | 90 days, shrinking to 47 by 2029 | 1 year, renewable up to 10 |
| Usual cause of lapse | Renewal automation broke silently | Card on file expired |
| What visitors get | Security interstitial they can click past | Nothing resolves; email stops too |
| Start renewing at | 30 days out | 60 days out |
Which one is closer to expiring?
Read the nearer of the two dates and treat it as the real deadline for that host. A certificate with 62 days left and a domain with 19 is not a healthy host. It is a host that goes dark in nineteen days, and the reassuring green number on the certificate row is the reason nobody noticed.
When the two dates land close together, renew the domain first. An expired certificate is loud and survivable: the browser throws a full-page warning, a determined visitor can click through, and the server behind it is still serving. Search engines and API clients refuse the connection outright, so it is a genuine outage for machines. But the fix takes minutes and the infrastructure never went anywhere.
An expired domain fails differently. The name stops resolving, so there is no server to warn about and no certificate to evaluate — requests die before TLS is negotiated. MX records disappear with the rest of the zone, which means mail to the domain bounces. That is what turns a lapse into an incident: the registrar’s password reset, the one you need in order to pay, is sent to an address that no longer accepts mail.
Recovery is slower too. Most gTLDs run an auto-renew grace period after the expiry date, then a redemption period of roughly 30 days where the registry still holds the name but restoring it costs a recovery fee rather than the renewal price. Once you have paid, DNS propagation adds hours on top before the site answers again.
Useful renewal windows: start on a certificate at 30 days remaining, and treat anything under 14 as broken automation to investigate rather than a renewal to run by hand. Act on a domain at 60 days. Once a year, open the registrar and confirm the card on file has not expired, since that one check prevents most domain lapses. If the name matters, push the registration out several years — a renewal you never have to make cannot fail.
Watching a host here tracks the certificate and alerts you 30, 14, 7 and 1 day before it expires. The domain date has no equivalent alarm yet, so put it in a calendar the day you run the check.
How it works
- 01
Enter a hostname
Type the domain you want to inspect — no protocol or path needed, just the host.
- 02
Run the check
Sitewell opens a TLS connection and reads the live certificate, then looks up the domain registration record.
- 03
Compare the dates
See days remaining on the certificate, the issuing authority, and the domain expiry date side by side.
Frequently asked questions
- What is the difference between SSL expiry and domain expiry?
- SSL expiry is the date the TLS certificate stops being valid. It is issued by a Certificate Authority, usually lasts 90 days on a Let's Encrypt cycle, and is normally renewed by automation. Domain expiry is the date your registration of the name lapses. It is held by a registrar, usually runs a year at a time, and is renewed by a payment. They come from different providers on different schedules and neither one knows the other exists. Both end in the same place: the site is unreachable. An expired certificate leaves the server running behind a browser warning; an expired domain stops the name resolving at all and takes email with it.
- Can I check SSL and domain expiration at the same time?
- Yes — that is what this checker does. Enter one hostname and it opens a live TLS connection to read the certificate's expiry date, days remaining and issuer, then looks up the registration record for the domain expiry date. Both come back in a single result, so you can see which of the two clocks runs out first without visiting a second tool.
- Does renewing my domain renew my SSL certificate?
- No. They are separate products from separate providers with separate clocks. Paying your registrar for another year of the domain does nothing to the certificate, which is issued by a Certificate Authority and expires on its own schedule. The reverse is also true: an automated certificate renewal will keep issuing valid certificates for a domain that is days away from lapsing. Track both dates.
- What happens if my domain expires but my SSL is still valid?
- The certificate becomes irrelevant. DNS for the name stops answering, so browsers never reach your server and never get as far as negotiating TLS — visitors see a resolution error, not a certificate warning. MX records go down with it, so mail to the domain bounces. Many registrars also park the expired name on an ad page. Recovery means paying the registrar, then waiting for DNS to propagate again.
- What happens when an SSL certificate expires?
- Once a certificate expires, browsers show a full-page security warning and block access until visitors click through, killing trust and traffic. Renew well before the expiry date — most teams set a reminder or monitor at least two weeks out.
- How often should I check my SSL certificate?
- Manually checking before each renewal is the minimum. Because certificates are easy to forget, the safer approach is continuous monitoring that alerts you a set number of days before expiry — Sitewell can watch a host and notify you automatically.
- Who issued my certificate, and does it matter?
- The issuer is the Certificate Authority that signed your certificate (for example Let's Encrypt, DigiCert, or Google Trust Services). It rarely affects visitors, but a sudden change in issuer can signal a misconfiguration or an unexpected reissue worth investigating.
- How long can an SSL certificate last?
- The ceiling is shrinking fast. Under the CA/Browser Forum schedule, the maximum certificate lifetime drops to 200 days in March 2026, 100 days in 2027, and just 47 days in 2029. Renewals that used to be a yearly chore become a monthly one — which is exactly why continuous expiry monitoring is replacing calendar reminders.
- How do I check a certificate's expiration date from the command line?
- With OpenSSL: echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates. The notAfter line is the expiration date. That command tells you nothing about the domain registration, though — for that you would run a second whois lookup. This checker does both reads at once.