Skip to content
Control Plane Labs
Search

Certificate Lifetime Checker

Check every certificate logged for a host against the CA/Browser Forum lifetime limits, see when it renews, and find coverage gaps.

Privacy: The domain you type goes to /api/cert-lifetime on this site. The edge function asks CertIndex, an index of the public Certificate Transparency logs, for certificates logged for that exact name. It sees your IP address only for rate limiting. Nothing is stored, and the data source is public.

Certificate Lifetime Checker

Your workspace Expand for more room

What it does

Type a host name. The checker reads the certificates Certificate Transparency holds for that exact name and answers the questions the shrinking lifetime schedule raises:

  • Lifetime against the limit. Each certificate’s validity is compared with the maximum allowed on its issue date under CA/Browser Forum Ballot SC-081: 398 days before March 15, 2026, 200 days now, 100 days from March 15, 2027 and 47 days from March 15, 2029.
  • Renewal timing. Certificates with the same issuer and names form a renewal series. The tool measures how many days each one had left when its replacement took over, and says whether that habit survives the next limit or Let’s Encrypt’s move to 64-day certificates.
  • Coverage gaps. Stretches when no certificate for the name was valid, which usually means an expired certificate was served or a renewal broke.
  • Parallel issuance. Several certificates for the same names issued days apart, a sign that each server or edge requests its own.

How it works

The query runs at /api/cert-lifetime, an edge function limited to thirty checks an hour. It reads up to 200 certificates for the name from CertIndex, an index of the public CT logs, merges each precertificate with its final certificate, and runs the analysis. If the index does not answer within nine seconds, you get a clear “try again” message rather than a hung page.

When to reach for it

  • Before March 15, 2027, to find hosts whose renewal thresholds assume 200-day or 90-day certificates.
  • When a certificate expired unexpectedly and you want to know if it was the first time.
  • When moving CAs or CDNs, to confirm the new setup renews on a sane schedule.
  • In a periodic review, next to the CT lookup, the TLS inspector and the CAA record checker.

The explainer walks through each finding, and our renewal timing chart shows how 28 developer domains renew today.

Frequently asked questions

What is the maximum lifetime of a TLS certificate today?+
Public TLS certificates issued on or after March 15, 2026 can be valid for at most 200 days under CA/Browser Forum Ballot SC-081. The limit drops to 100 days on March 15, 2027 and to 47 days on March 15, 2029. Certificates issued before March 15, 2026 could last up to 398 days.
How does the tool measure renewal timing?+
It groups certificates with the same issuer and the same set of names, then, for each certificate that was replaced before it expired, measures how many days it had left when the replacement's validity began. Replacements issued in the first fifth of a certificate's life are counted as parallel issuance, not renewals.
Why does it say a renewal threshold will misfire on 64-day certificates?+
Let's Encrypt moves its default to 64-day certificates on February 10, 2027. A client configured to renew at a fixed number of days before expiry, such as 60, would renew a few days after every issuance. ACME Renewal Info, or renewing when about a third of the lifetime is left, avoids that.
Does a coverage gap mean my site was down?+
Not necessarily. It means no certificate for this exact name in the index was valid during that period. The host may have used a wildcard or a certificate for another name, or the index may be missing an entry. If neither applies, clients saw an expired certificate.
Why does the tool find no certificates for my host?+
Certificates are matched by exact name. If your host uses a wildcard such as *.example.com, check the parent name. A newly added name can also take a short time to appear while the index loads its history.
Is a lifetime above the limit a mis-issuance?+
Possibly, but check first. The tool allows one day of slack because validity includes the final second. Confirm the notBefore and notAfter dates on crt.sh or in the certificate itself before you report it to the CA.

Related tools

Certificate Transparency Lookup

Look up indexed certificate observations for a domain, inspect coverage limits, discover names from SANs, and export the returned records as CSV.

TLS Certificate Inspector

Fetch a live certificate chain by hostname or paste a PEM. Decodes subject, SANs, validity, key and signature algorithms, fingerprints and embedded SCTs.

CAA Record Checker

Find the CAA record a CA will use for your domain, then check it against every CA that issued for the name in Certificate Transparency logs.

→ Read the full guide:How this tool actually works

Data from Certificate Transparency logs via CertIndex.