How to check SSL certificate expiry on Cloudflare
Cloudflare auto-renews the edge certificate it presents to visitors, but the origin certificate on your server (used with “Full (strict)” mode) does not auto-renew and is a frequent cause of outages.
Check the edge certificate visitors see
This is the certificate Cloudflare presents at its edge. It’s usually auto-managed, but worth confirming.
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -dates -issuerCheck the origin certificate
In the Cloudflare dashboard go to SSL/TLS → Origin Server to see your origin certificate’s validity. Cloudflare Origin CA certs can be valid up to 15 years — but they still expire, and nothing reminds you. Monitor the origin host directly (not through the edge).
Cloudflare SSL FAQ
How long is a Cloudflare Origin CA certificate valid for?
Up to 15 years — you choose the lifetime (the options top out around 15 years, roughly 5,475 days) when you generate it in SSL/TLS → Origin Server. That long validity window is exactly why teams forget about it: there’s no ACME-style 90-day cadence to build a habit around, so it lapses silently unless something outside Cloudflare is watching the date.
Does Cloudflare auto-renew my SSL certificate?
Only the edge certificate — the one Cloudflare presents to visitors — is auto-managed and auto-renewed. The origin certificate, used between Cloudflare and your server in “Full (strict)” mode, is generated once and does not auto-renew. You have to reissue and redeploy it yourself before it expires.
Why did my site go down with a valid Cloudflare edge certificate?
In “Full (strict)” mode, Cloudflare also validates the certificate on your origin server, not just the edge. If the origin certificate expired, Cloudflare fails the connection to your server even though the edge certificate visitors see looks fine — the outage is invisible from the browser’s address bar, which is what makes it confusing to diagnose.
Don’t want to run this by hand every month?
SSLNudge checks Cloudflare endpoints daily and alerts you before expiry.
Related errors
Tip: paste a hostname into the free SSL checker to see its expiry right now.