Free Certificate Readiness Check
Are your TLS certificates ready for 100-day and 47-day lifetimes?
Publicly trusted TLS certificates can last at most 100 days from and 47 days from ; the 200-day limit has applied since . Every certificate you renew by hand today will need renewing several times a year. This free SSL/TLS certificate expiry check shows which of yours are affected and how much renewal work is coming.
Maximum certificate lifetime
From
200 days
In force now
From
100 days
Next step
From
47 days
Final step
Schedule set by CA/Browser Forum Ballot SC-081v3 for publicly trusted TLS certificates. Last reviewed: .
How it works
Find every public certificate
We search public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded, to find your domain and its subdomains.
Check each host live over HTTPS
For each name we open a TLS connection on port 443 and read the certificate the server actually presents: issuer, expiry, TLS version and chain.
Estimate your renewal workload
We flag which certificates look manually renewed and project how many manual renewals per year the 100-day and 47-day limits mean for you.
Learn more
47-day certificates: the SC-081 timeline
The 200, 100 and 47-day TLS certificate limits from CA/Browser Forum ballot SC-081: dates, validation reuse, why it happens and renewals per year.
Automating certificate renewal with ACME
How to automate TLS certificate renewal with ACME: HTTP-01, DNS-01 and TLS-ALPN-01, wildcards, appliances that cannot run ACME, ARI and monitoring.
Certificate Transparency and your subdomains
How Certificate Transparency logs work, how to search them for your certificates and subdomains, what they reveal and how to keep internal names out.
Public data only
The check reads only public information: Certificate Transparency logs and the certificate your servers present to any visitor. We never ask for, access or store private keys, and we do not log in to anything. Reports are kept for 30 days and then deleted. How we handle data