# SSL certificate expiry checker

Most expiry checkers look at one hostname. Nameward checks your main domain,
`www`, and the subdomains that recently had certificates issued (found in
Certificate Transparency logs), connects to each, and reports what it
actually serves.

## What it tells you per host

- **Issuer and expiry date** of the certificate the server presents.
- **Status, relative to the certificate's lifetime:** Act now when little of
  its life is left (or it's expired, or not trusted for that name), Watch when
  most of it is used and no renewal has been seen.
- **Renewed but not installed:** a newer certificate for the same names is in
  the CT logs, but this server still serves the old one. The most common
  cause of "we renewed it and it still expired".
- Hosts that don't answer HTTPS from the internet are listed as such, not as
  errors.

## When a host needs action

1. Find where the certificate is installed: web server, load balancer, CDN or
   appliance.
2. Install the renewed certificate there, with its intermediate, and reload
   the service.
3. Check again from outside.

Step-by-step: [Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed),
and runbooks for [FortiGate](/guides/fortigate-replace-ssl-certificate),
[SonicWall](/guides/sonicwall-replace-ssl-certificate),
[Sophos Firewall](/guides/sophos-firewall-replace-certificate),
[IIS and Remote Desktop](/guides/iis-rds-replace-certificate) and
[Exchange hybrid](/guides/exchange-hybrid-certificate-renewal).

## Keep watching

Certificate lifetimes are shrinking to 47 days by 2029
([why](/guides/47-day-ssl-certificates)). Monitoring checks every few hours,
including hosts on other ports such as `vpn.example.com:4433`, and alerts you
before an expiry, not after.

---
Source: https://nameward.app/tools/ssl-expiry-checker (updated 2026-10-30)