FIPS 140 certificate expiry checker

From that certificate's own page in NIST's Cryptographic Module Validation Program register, which prints a "Sunset Date" field. No list page carries it, which is why each certificate here cites its own detail page and quotes the line that states it. The days remaining is arithmetic done in your browser against today's date — it is labelled separately from the date itself for that reason.

It is not an answer to that question, and it is labelled as a name match for that reason. It tells you how many Active FIPS 140-3 certificates are listed under the vendor name exactly as the register prints it — nothing more. The register keeps whatever name was on the original validation, so an acquisition hides a successor completely: FireEye's ten sunsetting certificates have no 140-3 under "FireEye", and those modules are listed under Trellix and Musarubra US LLC today — names that share no letters with the old one, so no string match could ever connect them. Search the register by the vendor's current name before concluding a module has nowhere to go.

Whether you must actually do anything. Historical is not Revoked: CMVP's own wording is that federal agencies "should not include these in new systems but can be procured for legacy systems", and a running system does not stop working on the sunset date. Whether your particular obligation bites depends on your contract, your authorisation boundary and whether you are standing up something new — none of which is on the register. What the 21 September sunset changes.