DevTransformFREE
Zero-Upload • 100% Client-Side
OpenSSL • Verification & Inspection

How to Check SSL Certificate Expiration Date from Domain or File

This command establishes a TLS connection to the remote host using SNI (`-servername`), extracts the server certificate, and pipes it to `openssl x509` to print the exact validity start (`notBefore`) and expiration (`notAfter`) timestamps.

Check Certificate Expiration Command
Safe • Read-Only / File Generation
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
Customize:
Domain:
Cert File:

OpenSSL Flags & Options Explained

-connect <host>:<port>Target hostname and TLS port (typically 443 for HTTPS)
-servername <host>Server Name Indication (SNI) header to route to correct virtual host
-noout -datesSuppresses raw certificate text and only prints valid date range
-checkend <seconds>Returns exit code 0 if certificate is valid for the next N seconds, 1 if expired

Execution Steps & Verification

1Check expiration of live remote domain

Query the target domain via s_client and print expiration dates:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
2Check expiration of a local certificate file

Inspect a .pem, .crt, or .cer file on disk:

openssl x509 -in cert.pem -noout -enddate
3Check if certificate expires within 30 days (automation check)

Automate alerting with -checkend (2592000 seconds = 30 days):

openssl x509 -in cert.pem -checkend 2592000 -noout && echo "Valid for >=30 days" || echo "Expiring soon!"

Common Security Pitfalls & Solutions

  • Always supply `-servername <domain>`! Without SNI, cloud providers (Cloudflare, AWS CloudFront, Kubernetes Ingress) will return an invalid default certificate instead of your domain certificate.
  • If querying from bash scripts, redirect stderr (`2>/dev/null`) and supply `</dev/null` so the connection closes immediately after the handshake.

Prerequisites & Environment

  • Outbound network access on TCP port 443 to target domain.

Frequently Asked Questions About Check Certificate Expiration

Frequently Asked Questions

Frequently Asked Questions

Everything you need to know regarding specifications, syntax, and security best practices.

By default, s_client remains open waiting for interactive input. Piping `</dev/null` sends an immediate EOF, allowing the command to exit promptly.

Related OpenSSL & Security Commands

View All Recipes
Generation & Keys

How to Generate a Self-Signed SSL Certificate with OpenSSL

reqGuide →
Verification & Inspection

How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)

x509Guide →
Verification & Inspection

How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)

x509Guide →
Generation & Keys

How to Generate a Certificate Signing Request (CSR) with SAN

reqGuide →
Format Conversions

How to Convert PFX / PKCS#12 to PEM Certificate and Private Key

pkcs12Guide →
Format Conversions

How to Convert CRT, CER or DER to PEM Format

x509Guide →