OneTaskBy Tim King · Updated
Certificate Expiry Calculator
Days Until a Certificate Expires and the Renewal Date, From Pasted PEM
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Certificate Expiry Calculator works
This certificate expiry calculator reads PEM certificates and tells you when each one expires, how many days are left and the date you should renew by. Paste a whole chain or a bundle of certificates to check them all at once and see which will lapse first.
What the certificate expiry calculator shows
Every X.509 certificate carries a notBefore and notAfter date. The calculator reads both, counts the days from now to notAfter and subtracts your renewal window to give a renew-by date. Each certificate gets a status of valid, renew now, expired or not yet valid, along with its subject common name and total lifetime, so you can tell the leaf from the intermediates.
Public TLS certificates are limited to 398 days today, and the CA/Browser Forum has voted to shorten that in stages to 47 days by 2029, so a 30-day renewal window that suited annual certificates may be too short for automated renewals. Let's Encrypt suggests renewing at two thirds of the lifetime. The calculator runs in your browser and nothing is sent anywhere.
FAQ
How do I get a site's certificate as PEM?
Run openssl s_client -connect example.com:443 -showcerts </dev/null and copy the blocks between the
BEGIN and END CERTIFICATE lines. Browsers can also export the certificate from the padlock menu, choosing
PEM or Base64-encoded X.509 as the format.
Why does the intermediate expire at a different time?
Intermediate and root certificates have their own lifetimes, usually years longer than the leaf. If an intermediate expires first, clients stop trusting your leaf too, so check every certificate in the chain you serve, not only your own.
What renewal window should I use?
For 90-day certificates renewed by ACME, 30 days is the common default. For annual certificates renewed by hand, allow 30 to 60 days for procurement and validation. As lifetimes shrink toward 47 days, a window of about a third of the lifetime keeps automated renewals safely ahead.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
SSL Certificate Inspector
Decode a PEM certificate and check its dates, names and fingerprints.
PEM Inspector
Decode PEM and DER into a readable ASN.1 tree.
CSR Decoder
Decode a CSR, verify its signature and spot problems before submitting.
TLS Cipher Suites
Every IANA TLS cipher suite with its code, parts and status.
Certificate Chain Order Checker
Check your SSL certificate bundle is complete and in the right order.