Certificate Expiry & Renewal Date Calculator

Understanding the certificate expiry and renewal date calculator — concept and principle

A TLS/SSL certificate is only trusted between its "not before" and "not after" timestamps. From the issue date and validity in days, this calculator gives the UTC expiry date, a renewal date and the days remaining. Use it to plan renewals of Let's Encrypt and other short-lived certificates or to set monitoring alerts.

How it is calculated

• Expires (UTC date) = issue date + validity days.
• Renew on = issue date + (validity days − renew-days-before-expiry), which is the same as expiry − renewal lead time.
• Days left from today = ⌈(expiry − now) ÷ 1 day⌉, rounded up so that any part of a day still counts as a day.

Days are added as exact 24-hour blocks from midnight UTC, so time zones and daylight saving cannot shift the result.

The principle

X.509 certificates (RFC 5280) carry two validity timestamps, and browsers reject a certificate outside that window. Shorter lifetimes limit the damage of a stolen key or mis-issued certificate. Let's Encrypt issues 90-day certificates, and its common client Certbot renews once 30 or fewer days remain. In 2025 the CA/Browser Forum approved Ballot SC-081, which lowers the maximum lifetime of publicly trusted TLS certificates in steps: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029.

Worked example

1. Inputs: issued 2026-11-08, validity 90 days, renew 30 days before expiry.
2. Expiry: 2026-11-08 + 90 days = 2027-02-06 (22 days left in November, 31 in December, 31 in January, then 6 in February).
3. Renewal: 2026-11-08 + (90 − 30) = 60 days = 2027-01-07.
4. Days left: measured on the issue day the result is 90; it falls by one each day after that.

How to read the result

Treat the renewal date as the latest comfortable date. Renewing a 90-day certificate at about two-thirds of its life (day 60) leaves 30 days to retry failed attempts. Under 14 days left on an automated certificate usually means automation is broken; a negative value means it has expired.

Common mistakes

• Reading the date in local time; the real expiry is a UTC timestamp and may fall on a different local day.
• Assuming a renewed certificate is live before the web server, load balancer or CDN reloads it.
• Forgetting other hosts that keep their own copy.

Frequently asked questions

Why are lifetimes getting shorter?

To limit how long a leaked key stays usable and make automated renewal the norm.

Does renewing early waste the remaining days?

The new certificate gets a full validity period from its own issue time; only the old one's unused days are dropped.

What happens when a certificate expires?

Browsers show a security warning and many API clients refuse to connect, so the site or service effectively goes down for most users.

Sources: IETF RFC 5280, Internet X.509 Public Key Infrastructure Certificate and CRL Profile (validity field) · CA/Browser Forum, Baseline Requirements for TLS Server Certificates and Ballot SC-081 · Let's Encrypt documentation, certificate lifetime and renewal recommendations