Certificate expiry check
We fetch the certificate the server serves right now from Korea and verify it. Expiry, chain, security grade and DNS in one view.
Thresholds: warn 30 · critical 15 days before (change)
With 'Warn' days or fewer left the verdict is WARN; with 'Critical' days or fewer it is CRITICAL.
Settings are saved in this browser only. For certificates with a lifetime under 90 days, the defaults shrink to 1/3 and 1/6 of the lifetime.
How and when it was measured
The chain exactly as the server sent it.
Checks TLS protocol support (handshakes from the Korea probe), security headers, the HTTP redirect and key strength. No port scanning.
Looked up through public DNS (Cloudflare DoH) and RDAP. The DNS operator is shown only when the nameserver names are on that company's domain.
Results of searching public incompliance cases in the Mozilla CA program (Bugzilla) by issuer name. They may not relate to this domain's certificate.
- README badge:
- Expiry calendar: .ics feed (Korean)
Alerts at 30 days (warn) and 15 days (critical) before expiry, then 7, 3 and 1 day before. If there is a problem, a 'check now' event is added.
- MCP for AI agents:
https://certdesk.dev/mcp(check_certificate tool)
How the verdict works
Three probes connect to the server, take the chain it sends right now, verify it against a trust store and check revocation through the certificate's CRL.
Korea probe A checks the chain and revocation as well. Korea B (KT Seoul) and Tokyo on the Globalping public network show regional and network differences. If the probes disagree, the verdict is WARN; if A is down, the public network result decides (status (Korean)).
If the server cannot be reached, the result is UNKNOWN, never OK.
What it checks
- Expiry
Based on the certificate the server serves. Within 30 days of expiry is WARN; within 15 days is CRITICAL. You can change the thresholds above.
Public CT logs are shown only as an estimate when measurement fails. If a newer certificate was issued for the same name but is not deployed, we tell you. Backup certificates a CDN keeps from another CA are ignored.
- Chain
Shown in the order the server sent it. If an intermediate is not sent, the verdict is a missing intermediate, with the name of the missing certificate.
If browsers work but Java, curl or mobile apps fail, this is usually why.
- Revocation
Checks the CRL listed in the certificate to see whether the issuing CA revoked it.
- Security grade
Graded on TLS 1.0/1.1 support, security headers such as HSTS, the HTTP to HTTPS redirect, and key and signature strength.
- DNS
Nameservers and their operator, IP owner, CAA (which CAs may issue), SPF and DMARC, DNSSEC, registrar and domain expiry.
- Ports and mail servers
Enter
host:portto check TLS ports other than 443 (8443, 6443, 636, 465, 993, 995 and so on) and STARTTLS (SMTP 25 and 587, IMAP 143, POP3 110, LDAP 389). Arbitrary ports are not accepted. - Per-address comparison
Fetches the certificate from each A/AAAA address of the domain to find servers that missed a replacement.
Check it yourself from a terminal
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subjectCA industry news View all →
Collected daily from official CA/Browser Forum posts and Mozilla CA incompliance cases.