How long are TLS certificates valid now?

Public certificates are capped at 398 days by CA/Browser Forum rules, and the industry is moving toward substantially shorter lifetimes. Manual renewal at that cadence is not sustainable — automate with ACME.

My certificate renewed but the site still shows the old one.

The service is still holding the previous certificate in memory. Reload or restart the web server, and check every node behind a load balancer.

Does an expired certificate break my site completely?

Effectively yes. Browsers show a full-page interstitial that most users will not click through, and API clients fail outright with no user to override.

Why does my subdomain expire on a different date?

It is a different certificate, often issued by different automation on different infrastructure. Monitor each hostname you actually serve.

Can I be warned before a certificate expires?

Yes, and you should be. Certificate Transparency logs record every publicly issued certificate, so monitoring services can alert on both impending expiry and unexpected issuance for your domains. Pair that with a check against the certificate the server actually presents, since a renewed file that was never loaded still serves the old one.

TLS & Email🌐 YAS server-sideAPI availableintermediate

SSL Certificate Expiry

Shows how many days until a host's TLS certificate expires.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Hostname

Loading tool…

What does this tool do?

Shows how many days until a host's TLS certificate expires.

Why would I use it?

You want to avoid surprise certificate expirations.
You are monitoring a portfolio of domains.
You are checking whether auto-renewal worked.

Real-life example

Input

example.com

Output

Expires 2027-01-01 — 142 days remaining

Renew well before the last 30 days.

Input → Process → Output → Next

Input: Enter a hostname.
Process: YAS fetches the certificate and computes days to expiry.
Output: Expiry date and days remaining.
Next action: Renew certificates approaching 30 days or fewer.

Common mistakes

Checking only port 443 defaults when the service uses another port.
Ignoring the renewal lead time of your CA.
Monitoring the apex but not subdomains.

What the result means

Days remaining = time before clients start seeing errors.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/ssl-expiry

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/ssl-expiry" \
  -H "Content-Type: application/json" \
  -d '{"host":"yas.sh"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/ssl-expiry", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "host": "yas.sh"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/ssl-expiry", json={"host":"yas.sh"})
data = r.json()

Field	Type	Required	Description
host	string	Yes	Hostname, e.g. yas.sh
port	integer	No (default 443)	TLS port

Success response

{ "host": "yas.sh", "daysLeft": 87, "notAfter": "...", "issuedBy": "...", "isExpired": false, "expiringSoon": false }

Days until a host's TLS certificate expires (live handshake).

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How SSL Certificate Expiry works

The tool opens a TLS connection to the host, completes enough of the handshake to receive the server's certificate chain, and reads the notBefore and notAfter fields from the leaf certificate. Those timestamps are absolute UTC values baked into the signed certificate — they cannot be extended, so renewal always means issuing a new certificate rather than modifying the existing one.

Expiry is only one of several ways a certificate stops working, but it is the one that is perfectly predictable and therefore inexcusable. Since the CA/Browser Forum reduced maximum lifetimes — 398 days, trending shorter — manual renewal has become untenable at any scale, which is why ACME automation and monitoring are now baseline operational requirements rather than refinements.

When to use it: real-world scenarios

Monitoring certificates you did not issue

Third-party endpoints, partner APIs and legacy appliances outside your ACME automation are exactly the ones that expire unnoticed on a Saturday.

Confirming a renewal actually deployed

A renewed certificate on disk is not a renewed certificate in the running process. Many outages come from a service that was never reloaded.

Checking every hostname, not just the apex

Subdomains often terminate on different infrastructure with separate certificates and separate renewal paths.

Verifying certificates on non-standard ports

Mail, database and admin services on 465, 993 or 8443 rarely feature in web-focused monitoring.

Pro tips

Alert at 30 and 14 days, not at 7. Renewal failures are often blocked by DNS or firewall changes that need lead time to fix.
Monitor the certificate the server actually presents, not the one in your configuration directory. A stale process serves the old one until reload.
Automate with ACME and then monitor the automation. Silent renewal failure is the common mode, not the absence of automation.
Check the whole chain: an expiring intermediate breaks validation even when the leaf is fresh.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Reports expiry and validity dates, not full chain validation or revocation status — use the TLS Analyzer for a complete assessment.
SNI-based virtual hosting means the certificate returned depends on the hostname requested; an IP-only check is meaningless.
Hosts behind IP allowlists or geo-restrictions may refuse the connection.
Certificates on internal networks are not reachable from public infrastructure.

Frequently asked questions

How long are TLS certificates valid now?: Public certificates are capped at 398 days by CA/Browser Forum rules, and the industry is moving toward substantially shorter lifetimes. Manual renewal at that cadence is not sustainable — automate with ACME.
My certificate renewed but the site still shows the old one.: The service is still holding the previous certificate in memory. Reload or restart the web server, and check every node behind a load balancer.
Does an expired certificate break my site completely?: Effectively yes. Browsers show a full-page interstitial that most users will not click through, and API clients fail outright with no user to override.
Why does my subdomain expire on a different date?: It is a different certificate, often issued by different automation on different infrastructure. Monitor each hostname you actually serve.
Can I be warned before a certificate expires?: Yes, and you should be. Certificate Transparency logs record every publicly issued certificate, so monitoring services can alert on both impending expiry and unexpected issuance for your domains. Pair that with a check against the certificate the server actually presents, since a renewed file that was never loaded still serves the old one.

Related tools

TLS Analyzer Certificate Info