SSL Expiry Countdown

Certificate lifespans are getting shorter

Auto-renewal was supposed to make expiry a solved problem. It hasn't. As of March 2026, no public CA can issue a certificate valid for more than 200 days. By 2029, that window shrinks to 47 days — roughly eight renewals a year instead of one. Let's Encrypt already defaults to 90 days, and has for years, because shorter lifespans limit the damage from a compromised key and force teams to automate. The CA/Browser Forum is pushing the rest of the industry the same way. If you want the full certificate breakdown — issuer, SANs, algorithm — run the SSL checker alongside this countdown.

Why auto-renewal fails quietly

Certbot runs, the cron fires, the cert renews. Until it doesn't. A DNS record changes during a migration, a firewall rule blocks the ACME challenge, a payment method expires on a commercial CA, or a hosting provider swaps the validation method without warning. The renewal fails, but nothing crashes — your site keeps serving the old certificate until the day it expires and every visitor hits a browser warning. That's the silent clock problem: everything looks fine right up to the moment it isn't. For domains you don't visit daily, a countdown like this is sometimes the only way to notice the timer is running out. Checking your certificate expiry alongside your domain WHOIS covers both clocks at once — they expire independently and rarely on the same schedule.

A countdown is not a reminder

This tool shows you the number right now. That's it — a snapshot. But with renewal cycles tightening, a manual check every few weeks won't cut it — you'll forget, or you'll check the wrong domain first. SSL certificate monitoring runs on a schedule and alerts you at 30, 14, or 7 days before expiry, through whatever channel your team actually watches. The difference between a countdown and a monitor is whether you find out on your terms or your visitors'.