SSL expiry checker

A browser page cannot open a raw TLS connection to an arbitrary hostname. Checking a certificate's not-after date needs a small server-side helper, for example a Cloudflare Worker. That is not part of this static demo, and nothing has been deployed to your Cloudflare account.

The live form is not available yet. The command below does the same job on the VPS itself, with no third-party checker in the middle.

Check a certificate from the shell

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates -issuer -subject

Replace example.com in both places. -servername matters when the box hosts more than one site. Look at notAfter. For a local file, use openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -dates.

What will ship later

A Worker can connect to a hostname you type, read the certificate, and return the expiry date, issuer, and days remaining. That still should not require logging in, and it should refuse internal addresses so the helper cannot be used to probe localhost or your tunnel. Until that backend exists, this page stays a reference — not a fake result.

On a small VPS, expiry surprises usually come from a cron-less Certbot install, a box whose port 80 is closed, or a certificate issued for the wrong name. Checking a week before renewal is calmer than checking after nginx starts logging handshake errors.