SSL & Domain Expiry Checker

They are two unrelated clocks. The SSL certificate is what your browser checks at the TLS handshake — typically valid for 90 days (Let's Encrypt) or up to 13 months (commercial CAs). The domain registration is what you pay your registrar (Cloudflare, GoDaddy, etc.) for — typically renewed once a year. Either one can expire without the other noticing. SSL expiry breaks HTTPS but the site still resolves; domain expiry makes the entire site disappear.

RDAP (Registration Data Access Protocol) — the IETF replacement for legacy WHOIS. Each TLD's registry publishes machine-readable JSON; we read what they publish. Most gTLDs (.com, .org, .net, etc.) are fully supported. Many ccTLDs (.se, .io, .uk) don't publish RDAP at all yet — for those, the registration section reports "no RDAP data" and the SSL section still works as usual.

Yes — and it happens more often than you'd expect. If the credit card on file expires, the renewal email goes to a defunct mailbox, or the original registrant left the company without handing off the account, a domain can lapse silently. Once expired, the domain enters a 30-day redemption window before being released to the public pool, where drop-catchers can grab it within seconds. The site doesn't just slow down; it stops resolving.

We open a TLS handshake to port 443 of the domain you enter and inspect the certificate the server presents — validity, expiry, issuer chain trust, hostname coverage. Separately, we query the TLD registry over RDAP for the domain's registration record — registrar, registration date, expiry, nameservers, status locks. Two independent reads, one page.

Cached for up to 24 hours to serve repeat lookups quickly. We do not associate the lookup with your identity.

The certificate side is the real TLS handshake — same data a browser sees. The registration side is whatever the registry publishes; some registrars update RDAP within minutes of a change, others take hours. Both are cached at the edge but always with the original fetch timestamp so you can see how fresh the data is.

The domain may be offline, port 443 may be closed, DNS may not resolve, or a firewall may be blocking our connection. Transient unreachability results are cached for only a few minutes — try rechecking shortly.

We accept Unicode domain names and normalize them to their Punycode (ASCII-compatible encoding) form before connecting, which is what TLS and RDAP actually use.

No. Even when RDAP servers return registrant name, email, phone, or address, we do not surface those fields. This is a deliberate product decision — registrar, expiry, registration date, nameservers, and status flags only.