# TLS Certificate Expiry Calculator

> Work out when a TLS/SSL certificate expires from its issue date and validity, how many days are left, and the date to renew with your chosen lead time.

Category: IT, networking & security · Applies to: Worldwide · Last updated: 2026-10-29
Interactive calculator: https://calculators.geekmidst.com/calculators/tls-certificate-expiry-calculator

A certificate stops being trusted after its “not after” date. Enter the issue date and lifetime (or expiry date) to see the days left and the latest comfortable renewal date.

Also called: SSL certificate expiry calculator, Certificate renewal calculator.

## Inputs
- Issued on (not before) (default 2026-10-01)
- Lifetime given as (options: Validity in days, Expiry date; default days)
- Validity (unit days; default 90)
- Expires on (not after) (default 2026-12-30)
- Check on (default ; optional)
- Renew this many days before expiry (unit days; default 30)

## Results
- Days until expiry
- Expiry date
- Renew on or before
- Status
- Certificate lifetime
- Lifetime used

## Formula

```
Expiry = Issue date + Validity days;  Days left = Expiry − Check date;  Renew on = Expiry − Lead days
```

Where:
- Validity days: certificate lifetime
- Lead days: how early you want to renew

## Worked example
1. 1 October + 90 days: +30 → 31 October, +30 → 30 November, +30 → 30 December 2026.
2. From 29 October to 30 December: 2 + 30 + 30 = 62 days.
3. Renewing 30 days ahead means by 30 November 2026.

**Result:** A 90-day certificate issued on 1 October 2026 expires on 30 December 2026: 62 days left on 29 October, renew by 30 November.

## What the result means

Automate renewal where you can (ACME clients such as certbot) and monitor the expiry date independently, since a missed renewal takes the site offline for visitors with a browser warning.

## Assumptions and limits
- Whole calendar days in UTC; the exact expiry time of day is in the certificate’s notAfter field.
- Maximum lifetimes for publicly trusted certificates are set by the CA/Browser Forum and are being reduced in stages; check your CA’s current limit.

## Questions

### How long can a public TLS certificate be valid?

The CA/Browser Forum’s ballot SC-081v3, passed in April 2025, reduces the maximum in stages from 398 days, starting in March 2026, to 47 days by March 2029.

### How do I find my certificate’s dates?

Click the padlock in your browser and view the certificate, or run openssl x509 -noout -dates on the certificate file.

## Sources
- [CA/Browser Forum: Ballot SC-081v3, reducing validity and data reuse periods](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/)

## Related calculators
- [Date Difference Calculator](https://calculators.geekmidst.com/calculators/date-difference-calculator)
- [DNS TTL Cache Window Calculator](https://calculators.geekmidst.com/calculators/dns-ttl-cache-window-calculator)
- [Password Entropy Calculator](https://calculators.geekmidst.com/calculators/password-entropy-calculator)

Source: GM¹X CalcVerse — https://calculators.geekmidst.com/calculators/tls-certificate-expiry-calculator