How to check an SSL certificate before it expires
Check the hostname, issuer, trust chain and service protocol — not just the expiry date. HTTPS and mail TLS require different tests.
A browser padlock does not tell the whole story. A certificate may still be valid while covering the wrong hostname, serving an incomplete chain or relying on an outdated TLS configuration.
Always test the exact service and port used by clients. A mail server on port 465 is checked differently from SMTP STARTTLS on port 587.
What to verify
Certificate health is a chain of checks. A valid date alone is not enough when clients cannot build trust to the issuing certificate authority.
- The hostname is present in the certificate SAN field.
- The notAfter date leaves enough time to repair automated renewal.
- The server provides the complete intermediate certificate chain.
- Modern TLS versions and appropriate cipher suites are negotiated.
- The test matches the service: HTTPS, SMTPS, STARTTLS, IMAPS or POP3S.
HTTPS, implicit TLS and STARTTLS differ
HTTPS, SMTPS and IMAPS start with a TLS handshake. STARTTLS first opens the application protocol and then upgrades it to encryption. Sending a regular TLS handshake to a STARTTLS port usually produces a cryptic protocol error.
For a mail platform, check each public endpoint separately: commonly 465/SMTPS, 587/SMTP STARTTLS, 993/IMAPS and, where used, 995/POP3S.
Choosing an alert threshold
Thirty days is a useful first warning for automatically renewed certificates. It leaves time to diagnose DNS, ACME challenge, issuer rate-limit or deployment failures.
A monitor should also notify you when the service recovers, so silence is not confused with a resolved incident.
SSL/TLS quick checklist
- Test the correct host, port and TLS mode.
- Verify SAN, issuer and the full chain.
- Set an expiry warning threshold.
- Test both failure and recovery notifications.
Put it into practice
Check a certificate with N3X
Select a service and port, review the complete TLS result and enable a free email alert.
Check a certificate with N3XFrequently asked questions
How early should an expiry alert be sent?
Thirty days is a practical default. Critical services can add 14-day and 7-day escalation thresholds plus a recovery notification.
Why does the certificate work in a browser but not in email?
The browser usually tests port 443 on a different hostname. Mail can use another certificate and either STARTTLS or implicit TLS.
Does a wildcard certificate cover the root domain?
Not automatically. *.example.com covers common subdomains, while example.com must normally appear separately in SAN.