All SSL certificates are valid for a limited period. Since 15 March 2026, a certificate can be valid for a maximum of 200 days, and this period will be further reduced in the coming years (to 100 days from 2027 and 47 days from 2029); an article on the background explains the shortening of certificate validity periods. Due to the shorter validity periods, it is becoming increasingly important to know when your certificate is due to expire and to ensure that the renewal process goes smoothly.

Check via your browser

1. Open your website.
2. Click on the icon at the left-hand end of the title bar (padlock or settings icon).
3. Select ‘Secure connection’, then choose ‘Certificate is valid’ (Chrome, Edge) or ‘View certificate’ (Firefox).

The ‘Validity’ section shows the start and expiry dates, as well as the issuer’s name.

Checking in cPanel

1. Log in to cPanel, go to the ‘Security’ section, select ‘SSL/TLS Certificates’, then click on the ‘Status’ tab. In the list of domains, you will see the expiry date after ‘Expires on’.
2. For each domain, you can see whether there is a valid certificate and when it expires.
3. You can also manually initiate the application for or renewal of free certificates using the ‘Run AutoSSL’ button.

If a domain does not receive a certificate, the error message displayed next to the list is explained in the article detailing AutoSSL errors and their causes.

Checking via the command line

On Linux, macOS or Windows (WSL), you can query the certificate for any server using the openssl command:

echo | openssl s_client -connect pelda.hu:443 -servername pelda.hu 2>/dev/null | openssl x509 -noout -issuer -dates

The notAfter line indicates the expiry date. To check whether the certificate will expire within the next 14 days, you can do the following (this can also be included in a script or cron job):

echo | openssl s_client -connect pelda.hu:443 -servername pelda.hu 2>/dev/null | openssl x509 -noout -checkend 1209600

Checking using an online tool

Using free online SSL checkers (such as the SSL Labs Server Test), as well as checking the expiry date, you can also see whether an intermediate certificate is missing and whether the server accepts an outdated TLS version.

Who takes care of the renewal?

• Free certificate on hosting: cPanel AutoSSL performs its renewal automatically before expiry, provided the domain points to the hosting account.
• Let’s Encrypt on your own VPS: renewal is handled by Certbot or another ACME client; the article on manually renewing Let’s Encrypt certificates explains how to check this. Let’s Encrypt has not been sending expiry notification emails since 4 June 2025, so you will need to keep an eye on the renewal yourself.
• Paid certificate: the annual plan includes two certificates, but the reissue of the second one is not automatic. Please initiate this in good time via the client portal; the steps are described in the article on reissuing paid SSL certificates.

What happens when a service expires?

Browsers display a full-page warning (NET::ERR_CERT_DATE_INVALID); most visitors leave the page at this point, and email clients also report an error. The article on the ‘Your connection is not private’ error discusses these error messages. You can choose from our range of SSL certificates if you require a paid certificate.