Check SSL expiry for every subdomain

To check subdomain ssl certificate expiry you need a current hostname inventory—DNS zone walks, CT search, and crawler hints—then a live TLS probe per name, because wildcards hide individual host deadlines in spreadsheets.

Platform teams assume a single wildcard covers “everything,” then learn that payments.example.com lives on another provider with a forgotten cert. Security reviews ask for “all subdomains” while DNS sprawl grows faster than CMDB updates.

This guide combines discovery sources with per-host openssl checks and explains wildcard limits—without encouraging intrusive subdomain brute force against third parties.

Marketing launches promo2026.example.com hours before Super Bowl ads while DNS and CT logs update faster than CMDB tickets. A disciplined check subdomain ssl certificate program catches those hosts before television traffic spikes.

Penetration testers and compliance auditors ask for complete TLS inventories. Combining CT, DNS, and live probes gives defensible coverage without claiming you scanned the entire internet.

What to check

Discovery must be authorized on domains you own. Use zone AXFR (if allowed), DNS provider APIs, certificate transparency, and internal service catalogs—not unchecked aggressive DNS wordlists against strangers.

For each candidate host, record TLS notAfter, whether the cert is wildcard or per-host, and if CNAME chains point off-domain (SaaS) where you do not control renewal. Expiry on a wildcard covers matching names only; some hosts need dedicated SAN rows.

Contrast with wildcard SSL certificate expired when *.example.com is valid but a non-matching hostname still fails name checks despite fresh dates on the wildcard PEM.

Step-by-step

List names from Certificate Transparency

curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r '.[].name_value' \
  | tr ' ' '\n' \
  | grep -E '\.example\.com$' \
  | sort -u

See certificate transparency logs search for filtering noise.

DNS zone dump (Cloudflare API example)

curl -s -H "Authorization: Bearer $CF_TOKEN" \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?per_page=500" \
  | jq -r '.result[] | select(.type=="A" or .type=="AAAA" or .type=="CNAME") | .name' \
  | sort -u

Adapt tokens and pagination for your DNS vendor.

Probe expiry for each discovered host

while read -r host; do
  end=$(timeout 12 bash -c \
    "echo | openssl s_client -connect '${host}:443' -servername '${host}' 2>/dev/null \
     | openssl x509 -noout -enddate 2>/dev/null") || end="ERROR"
  echo -e "${host}\t${end}"
done < subdomains.txt | tee subdomain-expiry.tsv

Compare wildcard versus hostname-specific certs

echo | openssl s_client -connect www.example.com:443 -servername dev.example.com 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName

If SAN shows only *.example.com, child hosts match; if a host returns a different issuer, it may be on separate infrastructure.

Feed results to CSV monitoring

Merge subdomain-expiry.tsv into the format described in check SSL expiry for multiple domains from CSV for executive sorting.

How to read the output

ERROR rows mean no HTTPS listener, firewall block, or wrong name—not necessarily missing cert. Identical notAfter across dozens of hosts often indicates one wildcard or shared load balancer PEM.

Scattered expiries suggest per-app certs or multiple hosting providers. Earlier expiry on api. than www. is common when API gateways use shorter-lived ACME certs with failed automation.

CNAME to *.github.io or similar shows foreign issuers—track renewal in the SaaS console, not only your wildcard on the apex.

Pivot subdomain spreadsheets by first label (api, dev, legacy) to spot environment patterns. Security champions use those pivots to argue for consolidating dev hosts behind a single reverse proxy with centralized renewal.

When CT lists a host your DNS zone lacks, investigate takeover risk or shadow IT before deleting—orphan CT entries sometimes precede live phishing infrastructure. Loop legal if external agencies obtained certificates for names you thought were retired.

Document probe timestamp on every row. Subdomain inventories rot quickly; leadership should see collection time beside expiry time when approving budget for monitoring SaaS.

Common mistakes

Relying on wildcard renewal while several hosts use certificate pinning or HSTS preload on dedicated certs—one host expiring breaks only that product surface.

Enumerating subdomains via public brute force without change control creates noise and legal/policy risk. Stay within assets you administer.

Checking only CT and skipping live probes—CT lists historical issuances, not current bindings.

Omitting internal subdomains that never appear in CT (internal.example.com on private CA). Add those from DNS or service mesh registries.

Probing CNAME targets with the wrong SNI (using the vanity name against the provider’s cert). Use the customer hostname in -servername even when TCP connects to SaaS edges.

When to use automation

Nightly CT + DNS API jobs rebuild subdomains.txt and diff new names since yesterday. Auto-open tickets for first-seen hosts with <30 day notAfter or ERROR after three retries.

Apply tiering: daily live checks on revenue subdomains, weekly sweeps on the long tail. Wildcard renewal alerts should still fire at the PEM level, while per-host monitors catch exceptions.

External monitoring (ssldays-style) discovers redirect chains users hit. Pair with OpenSSL check certificate expiry date for incident drill templates.

After acquisitions, import both CT and registrar DNS exports before declaring coverage complete.

Tag each discovered host with business owner in your spreadsheet. Renewal conversations stall when engineering knows expiry dates but not who pays for the SaaS certificate behind a CNAME.

Review wildcard renewal tickets alongside subdomain sweeps. If wildcard notAfter is healthy but a child host errors, you likely have a one-off cert or misconfigured SNI on a microservice mesh.

Exclude third-party domains from bulk openssl loops even if CT mentioned them in relation to your brand—only probe names you administer or contracts authorize, and record legal approval identifiers when security performs courtesy scans for partners.

Reconcile subdomain lists with certificate orders from procurement. SAN lists on OV orders sometimes omit new microsites that DNS already advertises publicly.

Brand teams launching regional subdomains under country-coded second levels need explicit guidance: a wildcard on the marketing apex does not automatically cover every delegated child zone operated by a franchisee. Franchise contracts should state who runs TLS expiry monitoring for local hosts so customers never see mixed expired storefronts.

Education subdomains for universities sprawl each semester; combine CT queries with student information system exports where policy allows, then dedupe against DNS anycast answers to avoid double-counting retired course sites that still resolve but redirect centrally.

Game studios running playtest subdomains rotate hostnames weekly; treat those labels as ephemeral in monitoring tiers with shortened warning windows intentionally, rather than forcing the same thirty-day policy as corporate www properties.

Journalists covering your organization may cite crt.sh entries when investigating phishing; proactive subdomain hygiene reduces reputational damage when criminals obtain certificates for lookalike labels you never owned. Legal may request CT exports—know how to produce them quickly with documented query parameters.

Service mesh sidecars sometimes terminate TLS inside Kubernetes with certificates distinct from ingress controllers. Subdomain inventory must include internal service DNS names when platform SRE owns renewal, even if those names never appear in public CT.

Reward teams that close discovery gaps quickly: when engineering adds a subdomain row before issuance, celebrate reduced risk rather than punishing previous omission. Positive culture increases voluntary DNS submissions.

Archive retired subdomain rows with decommission dates instead of deleting history, so postmortems explain why monitoring stopped and who approved teardown.

Customer success managers hearing about check subdomain ssl certificate programs should know it protects upsell demos too. Temporary partner portals tied to subdomain DNS entries expire quietly when sales moves on unless discovery pipelines include CRM campaign codes mapped to DNS labels.

Industrial IoT deployments sometimes expose device dashboards on obscure fourth-level names. Include those in worksheets when plant networks federate TLS termination through central IT, even when OT teams insisted they were air gapped.

Journalism about your industry may quote Certificate Transparency without context; prepare executive talking points explaining legitimate issuance spikes during product launches so public relations is not blindsided by technical tweets.

University ethics boards reviewing student projects using live subdomain scans require written scope documents listing authorized zones. Store approvals beside scan results to defend responsible disclosure if students find expired certs on alumni sites.

Athletics departments spin up ticket sale subdomains each season with independent vendors. Contract language should require vendors to export notAfter weekly into shared spreadsheets until centralized monitoring ingests their APIs.

Biweekly standups between security and growth marketing should review newly discovered subdomains so promotional urgency does not outpace TLS ownership assignments, procurement lead times for OV orders, or DNS cutover windows published in launch calendars.