Type a domain below. We open a TLS connection to it and read the expiry date out of the certificate that server is handing out right now — along with its registry, transfer-lock and email records.
Enter the domain above. Renewatch opens a TLS connection to it and reads the notAfter date out of the certificate the server actually presents, so the answer describes the certificate in production rather than one issued at some point in the past.
In practice, yes. TLS is the protocol that replaced SSL in 1999; everyone kept saying "SSL certificate" and the name stuck. The certificate itself is the same file either way.
Every browser stops the visitor with a full-page security warning that most people will not click through, and anything calling the domain over HTTPS — APIs, webhooks, payment callbacks — fails outright. There is no grace period, and it happens at the exact second the certificate lapses.
It tries to, starting a month before expiry, which is why an expired certificate almost always means the renewal job has been failing silently for weeks — a dead cron, a moved webroot, a DNS credential that lapsed. Auto-renewal reports intent, not outcome. The only proof is the date on the certificate being served moving forward, which is what we watch.
Yes, and we say so rather than guessing. Sites behind Cloudflare cannot be read from where our checks run, so we report that the certificate is Cloudflare-issued and renewed automatically instead of inventing a date. A server that refuses everything but TLS 1.3 reads as unreadable, never as healthy.
Also: When does my domain expire? · Is this domain available?
