Ravindra BagaleCourses & study guides Track your progress

Guides

How to Check SSL Certificate Expiry with OpenSSL

By , Cyber Security trainer LinkedIn Published: Last updated:

To see when a site certificate expires, run echo | openssl s_client -servername SITE -connect SITE:443 2>/dev/null | openssl x509 -noout -dates. Read notAfter. Renew with Certbot before that date. Checking expiry is read-only and safe on public HTTPS sites you administer.

Quick answer

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Why check expiry?

An expired certificate breaks trust. Customers leave. Apps fail health checks. Fatima in Dubai and Vivek in Indore both lost a morning to a silent expiry. One command would have warned them.

What are you reading?

A public HTTPS site presents an X.509 certificate. notBefore and notAfter are the validity window. OpenSSL can print them without changing anything on the server.

How do I check step by step?

  1. Choose the live hostname you manage, for example shop.example.com.
  2. Fetch and print dates: 
    echo | openssl s_client -servername shop.example.com -connect shop.example.com:443 2>/dev/null | openssl x509 -noout -dates -subject
    subject=CN = shop.example.com
notBefore=Aug  1 00:00:00 2026 GMT
notAfter=Oct 30 00:00:00 2026 GMT

    What it means: This cert ends 30 Oct 2026 UTC. Plan renew before that day.

  3. Check a PEM file on the server (after Certbot): 
    sudo openssl x509 -in /etc/letsencrypt/live/shop.example.com/fullchain.pem -noout -enddate

    What it means: Reads the file Certbot stored. Useful when DNS is temporarily wrong.

  4. See days left (GNU date example): 
    end=$(echo | openssl s_client -servername shop.example.com -connect shop.example.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
date -d "$end" +%s  # then compare to now

    What it means: Scripting the end date lets cron warn you.

  5. Renew early: sudo certbot renew --dry-run then real renew on a timer.

Ravindra Bagale's Tip

Set a calendar alert 21 days before notAfter. Let's Encrypt certs last about 90 days. Meera in Hyderabad automates this with a tiny cron that emails the team if fewer than 20 days remain.

Quick quiz: check what you learned

  1. Which openssl field shows when a certificate expires?

    1. notAfter date in the certificate
    2. notCool field in the certificate
    3. TTL value from a dig query
    4. MX record from DNS lookup
    Show answer

    A. notAfter is the expiry timestamp openssl x509 prints.

  2. Why pass -servername when checking a shared HTTPS host?

    1. So SNI returns the correct virtual-host certificate
    2. So you can hack the certificate authority
    3. So you can skip DNS resolution entirely
    4. So you can force the server onto plain HTTP
    Show answer

    A. SNI selects which certificate the server presents.

  3. When should you renew a Let's Encrypt certificate?

    1. Days before notAfter, via automated renew
    2. One full year after the cert expires
    3. Never renew; wait for browsers to fail
    4. Only on Fridays during maintenance
    Show answer

    A. Automate renew a few days before expiry.

Learn it properly

This guide is the short path. These pages go deeper, with labs:

Frequently asked questions

What is the openssl command to check certificate expiry?

echo | openssl s_client -servername SITE -connect SITE:443 2>/dev/null | openssl x509 -noout -enddate

What does notAfter mean?

The last moment the certificate should be trusted. After that, browsers show a warning.

Does this work for IP addresses?

TLS usually needs a hostname (SNI). Prefer the DNS name.

How is this different from installing a cert?

This guide only reads expiry. Installing is covered in the Certbot on EC2 guide.

Can I check a local PEM file?

Yes: openssl x509 -in fullchain.pem -noout -dates