Type your domain above to check a Let's Encrypt certificate. You'll see the issuer, the expiry date and days left, the names it covers and whether browsers trust the chain. Let's Encrypt's default certificates are valid for 90 days, and it recommends renewing them every 60 days. So a working setup should rarely get close to zero days left.
How to check a Let's Encrypt certificate
- 1Type the domain without https://, such as example.com, and press Check.
- 2Look at the issuer. A certificate from Let's Encrypt names Let's Encrypt as the issuer. If you see another company's name, your host or CDN is serving its own certificate, not the one your ACME client set up.
- 3Look at the days left. If your client renews every 60 days, a 90-day certificate should always have plenty of time left. If the number keeps going down week after week, renewal is failing.
- 4Look at the names. Each hostname you use, such as www and the bare domain, has to be on the list. If a name is missing, browsers show a warning on that hostname.
- 5Look at the chain. If browsers don't trust it, the server is usually sending the certificate without its intermediate. Point your web server at the full chain file your client saved.
Lifetimes are getting shorter
Let's Encrypt also offers short-lived certificates valid for six days. It recommends renewing those every three days. It plans to cut its 90-day certificates to 45 days by 2028. If your renewal runs on a fixed 60-day timer, it will start to fail once that happens. Let's Encrypt recommends that ACME clients use ACME Renewal Information (ARI) so they renew on time.
Let's Encrypt stopped sending expiry reminder emails in June 2025. Nobody will email you before a certificate runs out, so set your own reminder to check the days left. From Let's Encrypt's FAQ and announcements, read in October 2026.
Revocation, renewals and DNS records aren't checked
It reads the certificate your server sends on port 443 and nothing more. It doesn't check revocation. It doesn't run your ACME client or test whether the next renewal will work. It doesn't look up the DNS TXT records used for DNS challenges. It doesn't list every certificate Let's Encrypt has issued for your domain, and it doesn't send expiry reminders.
This sSL checker is free with no signup. SearchBlueprint, who make it, sell SEO planning for websites: which searches each page should answer.