SSL Certificate Expiry Calculator
Check a TLS certificate's days left, renewal date and lifetime, or find the maximum lifetime by issue date: 200 days now, 100 in 2027, 47 in 2029.
Scenarios
Each one sets every field and is dated from today.
Days left, when to renew, and whether the lifetime is possible for a public certificate.
Your certificate
Both dates are on the certificate: open it from the padlock or site-information icon in the address bar, or run openssl x509 -noout -dates.
Maximum lifetime by issue date
Public maximum: CA/Browser Forum Baseline Requirements v2.3.0, section 6.3.2, for every publicly trusted TLS certificate, DV, OV and EV alike. Let's Encrypt: the default profile's announced schedule; its opt-in profiles already issue 45-day and 160-hour certificates.
| Issued from | Public maximum | Let's Encrypt |
|---|---|---|
| BeforeMar 15, 2026 | 398 days | 90 days |
| Mar 15, 2026 | 200 days | 90 days |
| Feb 10, 2027 | 200 days | 64 days |
| Mar 15, 2027 | 100 days | 64 days |
| Feb 16, 2028 | 100 days | 45 days |
| Mar 15, 2029 | 47 days | 45 days |
Counts are calendar days in your time zone. A certificate stops working at the exact moment in its notAfter field, which your browser's certificate viewer or openssl x509 -enddate prints. Where your ACME client supports ARI, your certificate authority's renewal window takes precedence over the one-third rule.
Related Calculators
You might also find these calculators useful
Days Between Dates
Calculate days between two dates
Encryption Key Strength Comparison
See which AES, RSA, ECC and hash key sizes are equally strong.
JWT Token Size Calculator
Measure a JWT and check it against cookie and header limits
Zero Trust Maturity Assessment
Rate every row of CISA's Zero Trust Maturity Model and see your next stage
Certificate lifetimes are shrinking
Since March 15, 2026, a publicly trusted TLS certificate can last at most 200 days, down from 398. The maximum falls to 100 days on March 15, 2027 and to 47 days on March 15, 2029, under a schedule the CA/Browser Forum adopted in April 2025. This calculator does two jobs: it checks a certificate you already have (days left, when to renew, and whether its lifetime is possible), and it gives the maximum lifetime for a certificate issued on any date.
How certificate expiry works
Every certificate carries two dates, notBefore and notAfter, and is valid from the first through the second, inclusive (RFC 5280). After notAfter, browsers refuse the connection: Chrome reports NET::ERR_CERT_DATE_INVALID, the same error a wrong device clock produces, because the browser compares the dates with its own clock. How long a public certificate may last is set by section 6.3.2 of the CA/Browser Forum Baseline Requirements: 398 days for certificates issued before March 15, 2026, 200 days from then, 100 days from March 15, 2027 and 47 days from March 15, 2029. Certificates from a private or internal certificate authority are outside those rules and can last as long as their issuer allows. For renewal, Let's Encrypt recommends using ACME Renewal Information (RFC 9773) where the client supports it and, as a backstop, renewing with a third of the lifetime left, or halfway through for certificates valid under 10 days.
Renewal date
Renew on = Expires − ⌈Lifetime ÷ 3⌉ (⌈Lifetime ÷ 2⌉ below 10 days)How to use this calculator
Pick a scenario, or choose Check a certificate or Plan a certificate.
To check a certificate, enter its issue and expiry dates. Both appear in the browser's certificate viewer, and openssl x509 -noout -dates prints them as notBefore and notAfter.
Read the verdict: days left, the renewal date, and whether the lifetime fits the public maximum for its issue date.
To plan, enter the date a new certificate will be issued, such as your next renewal, to see the longest it can last and how often it will need renewing.
Use the table to see how the maximum changes over time, and what Let's Encrypt's default profile issues.
Common use cases
Planning around March 15, 2027
An operations team sees that renewals scheduled for late March will get 100-day certificates, and moves the busiest ones before the cut.
Sizing renewal automation
An engineer works out that 47-day certificates renewed at a third of their lifetime mean about 12 renewals a year per domain, and budgets the automation for it.
Auditing internal certificates
A security reviewer confirms that a 730-day certificate is from the internal CA, not a public certificate issued with impossible dates.
Explaining an outage
After a site shows NET::ERR_CERT_DATE_INVALID, an administrator checks when the certificate expired and when it should have been renewed.
Why the dates matter more every year
Renewals are about to get frequent
Renewing with a third of the lifetime left means a renewal about every 265 days at the old 398-day maximum, every 133 days at today's 200, and every 31 days at 47, which is about 12 renewals a year for each certificate.
An expired certificate takes the site down
Browsers show a full-page warning instead of the site, and nothing clears it for visitors except installing a valid certificate. A renewal date set from the lifetime leaves room to fix a failed renewal first.
The limit depends on the day you renew
A certificate issued on March 14, 2027 can last 200 days, until September 30, 2027. One issued a day later can last only 100, until June 23, 2027.
A long certificate is not always wrong
A two-year certificate is impossible for a public certificate authority today but normal for an internal one. The lifetime check tells the two cases apart instead of calling both healthy.
Frequently asked questions
200 days, for a certificate issued between March 15, 2026 and March 14, 2027. Certificates issued before March 15, 2026 could last up to 398 days, so some of those stay in use until mid-April 2027.
Yes. 200 days is about six and a half months. The maximum falls to 100 days, about three months, for certificates issued from March 15, 2027, and to 47 days from March 15, 2029.
With certificates issued on or after March 15, 2029. The CA/Browser Forum adopted the schedule in April 2025 (Ballot SC-081v3): Apple, Google, Microsoft and Mozilla voted for it, and no certificate issuer voted against. From the same date, a certificate authority can reuse a domain validation for only 10 days.
Its default certificates last 90 days. Let's Encrypt has announced that the default falls to 64 days on February 10, 2027 and to 45 days on February 16, 2028. Its opt-in profiles already issue 45-day certificates and short-lived ones of 160 hours, about six days.
Where your ACME client supports ACME Renewal Information (RFC 9773), let it: the certificate authority then says when to renew. As a backstop, Let's Encrypt recommends renewing with a third of the lifetime left, or halfway through below 10 days. That is 30 days before expiry for a 90-day certificate, 67 for a 200-day one and 16 for a 47-day one. A fixed 60-day renewal interval stops working once lifetimes fall below it.
In a browser, open the certificate from the padlock or site-information icon in the address bar; it lists when it was issued and when it expires. In a terminal, openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -dates prints notBefore and notAfter, and openssl x509 -checkend 2592000 exits with an error if a certificate expires within 30 days.
Browsers refuse the connection and show a full-page warning; in Chrome the error is NET::ERR_CERT_DATE_INVALID. A device with a wrong clock shows the same error, because the browser checks the certificate's dates against its own clock. Visitors cannot reach the site normally until a valid certificate is installed.
No. The EV Guidelines apply the same section 6.3.2 schedule to EV certificates, and OV and DV certificates fall under it directly. The validation level changes how much the certificate authority checks about the owner, not how long the certificate lasts.
Because the time between its two dates exceeds the public maximum for its issue date by more than a day. The one-day allowance covers the time of day and your time zone. Certificates from a private or internal CA are not covered by the rule and can last for years; for a public certificate, check that both dates were copied correctly.