OpenSSL: check certificate expiry date

openssl check certificate expiry by reading notBefore and notAfter on the exact certificate your clients see—whether that PEM lives on disk or arrives over port 443.

OpenSSL ships on virtually every Linux server, macOS install, and most CI images. Operators use it to decode X.509 validity windows without opening a browser. The same commands work on certificate files from a vendor zip and on handshakes fetched from production.

This guide targets DevOps and support engineers who need reproducible evidence: one-liners for incidents, slightly richer output for change requests, and reminders that file inspection is not a substitute for live checks behind load balancers.

You need the OpenSSL CLI and network egress for remote hosts. Replace HOST with the public name unless you intentionally test an internal listener with matching SNI.

Small teams run the same commands on laptops before executive demos. Larger teams embed them in CI so staging cannot promote with twenty-four hours of remaining validity unless a waiver ticket exists.

What to check

Every certificate carries notBefore (first valid instant) and notAfter (last valid instant), usually in GMT. openssl check certificate expiry should include serial number and subject when triaging renewals so you can prove the served cert changed.

Inspect each link when using -showcerts: leaf, intermediates, and any unexpected extras. An expired intermediate breaks trust even when the leaf’s notAfter looks fine.

Separate file on disk from handshake presentation. Both matter; they should match serials after deploy.

openssl check certificate expiry on archived zips from vendors should include intermediate files when the zip bundles them. Customers sometimes import only the leaf into a keystore while the intermediates remain in Downloads.

Step-by-step

PEM file on disk

openssl x509 -in /path/to/cert.pem -noout -dates -serial -subject -issuer

For a full chain file, split or parse each PEM block. Quick view of all certs in a bundle:

awk 'BEGIN{c=0}/BEGIN CERT/{c++}{print > "/tmp/cert-" c ".pem"}' /path/to/fullchain.pem
for f in /tmp/cert-*.pem; do echo "== $f =="; openssl x509 -in "$f" -noout -dates -subject; done

Live HTTPS host (default 443)

HOST=www.example.com
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" 2>/dev/null \
  | openssl x509 -noout -dates -serial -issuer

Custom port

echo | openssl s_client -connect api.example.com:8443 -servername api.example.com 2>/dev/null \
  | openssl x509 -noout -dates

Days remaining (shell arithmetic)

end=$(echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
  | openssl x509 -noout -enddate | cut -d= -f2)
echo "notAfter: $end"

Parse end with date -d on GNU systems or date -j on BSD for countdown scripts.

When scripting, log OpenSSL version in output. Corporate golden images lag upstream releases; date parsing bugs are rare but support tickets are easier when versions are visible.

STARTTLS (SMTP example)

openssl s_client -connect mail.example.com:587 -starttls smtp -servername mail.example.com 2>/dev/null \
  | openssl x509 -noout -dates

How to read the output

notBefore= and notAfter= use ASN.1 GeneralizedTime strings, commonly like Mar 14 12:00:00 2026 GMT. Compare against current UTC. After notAfter, verification libraries return “certificate has expired” regardless of issuer reputation.

serial= identifies a specific issuance. After renewal, serial should change. If dates on disk updated but serial over the internet did not, reload or fix propagation first.

issuer= tells you which CA signed the cert. A new issuer after migration may require updated intermediate bundles on the server.

subject= plus SAN extensions (use -ext subjectAltName on files) confirm name coverage. Future dates with wrong names still fail hostname verification in clients.

Convert notAfter to UTC when comparing against monitoring SaaS timestamps. Mixed local timezones across continents produce off-by-one-day escalations near midnight boundaries.

Common mistakes

Checking only cert.pem while the web server serves fullchain.pem from another directory. Trust your configuration paths, not assumptions.

Forgetting -servername when connecting to an IP address. You read the default cert’s dates, which may expire years ago on unused vhosts.

Using local timezone when comparing notAfter. OpenSSL prints GMT; skewed laptop clocks cause false panic—sync NTP on jump hosts.

Reading the first PEM in a download when the CA included cross-signed intermediates you are not serving—clients may hit the expired cross-sign.

Assuming openssl x509 on disk means users are safe without a post-reload handshake test.

Quoting only notAfter in executive email without context. Add hostname, environment, and whether the check was file-based or live to prevent duplicate work across teams.

When to use automation

Copy-pasting OpenSSL one-liners does not scale across hundreds of SANs and regional endpoints. Automate live TLS monitoring with the same hostname users type, and store historical notAfter for audit.

Trigger alerts at 30, 14, 7, and 1 day before expiry. Combine with RDAP domain expiration when registries publish dates so validation is not blocked by registrar issues. ssldays runs external checks aligned with OpenSSL semantics—useful when cron already parses local PEMs but strangers still see old serials.

Scenario walkthrough

A platform engineer receives a pager item because a bash cron job parsing PEM files shows three days of validity left on a wallet service. They run openssl check certificate expiry live with s_client and discover the wallet cluster never received Sunday’s renewal. The file on the ACME host was fresh; deployment automation lacked a restart step. The moral: always re-run live checks before downgrading alerts.

University IT often stores certificates in ticketing attachments. Auditors sample random hosts and ask for proof. Attaching openssl x509 -noout -dates output from both disk and network validates operational control better than screenshots of GUI wizards.

Windows shops export PFX from MMC for Linux terminators. Someone forgets to include intermediates in the export. OpenSSL on the Linux box shows fine leaf dates while browsers fail. Checking each PEM split out of the PKCS#12 bundle catches the missing intermediate before cutover.

Short-lived development certificates sometimes use clocks synced to hypervisors that drift. notBefore in the future triggers confusing errors that feel like expiry. The engineer checks notAfter, then notices notBefore tomorrow. NTP fixes the host; OpenSSL commands stay the same diagnostic.

Finance asks whether renewing early wastes money on commercial OV certs. Operations respond with historical notAfter logs proving they renew inside thirty-day windows due to change control, not due to misunderstandings of OpenSSL output. Saved command transcripts become budget justification.

Daily operator habits

Treat openssl check certificate expiry like a vital sign. Morning standups for platform teams can include one random hostname from the pager rotation, checked live with s_client and recorded in chat with serial and notAfter. The ritual catches drift when automation emails were muted for the holiday weekend.

Keep a personal cheat sheet of ports beyond 443 your company uses: partner APIs on 8443, metrics on 9090 with TLS, legacy admin UIs on alternate listeners. Rotate through that list monthly even if production dashboards look stable.

When pairing with new hires, have them run file-based and network-based checks on the same staging host. Comparing outputs teaches symlink layouts and SNI faster than architecture diagrams alone.

Before vendor calls, attach fresh OpenSSL output to the ticket. Support engineers waste less time when customers prove whether the problem is presentation or configuration rather than arguing about screenshots.

If you maintain war rooms during major marketing events, assign a scribe who only records OpenSSL dates and serials each hour for flagship domains. Spikes in traffic do not stop certificates from aging; the log becomes invaluable if rollback is debated at 3 a.m.

Legacy Java keystores still appear in enterprise estates. Export to PEM temporarily for openssl x509 inspection rather than guessing validity from GUI panels alone.

IoT firmware may embed certificates without easy filesystem access. Document manufacturer tools for expiry; OpenSSL on a laptop against the device’s HTTPS interface remains the universal fallback.

When automating, prefer parsing enddate machine output over locale-sensitive human strings. Pipelines stay stable across Debian and Alpine images used in Kubernetes hooks.

Rotating EV certificates may involve offline ceremonies; openssl check certificate expiry on delivered files still happens days before installation windows. Track both ceremony dates and future notAfter in program plans.

If teammates paste expired cert screenshots into chat, reply with a fresh OpenSSL command output. Cultural habits shift when evidence replaces opinions in public channels.

Disaster recovery drills should include fetching expiry from cold-site listeners before DNS flips. Warm databases do not help if TLS on the DR VIP is years out of date.

Compare OpenSSL outputs across OpenSSL 1.1 and 3.x jump hosts during migrations. Field formats rarely change, but provider differences occasionally surprise scripts parsing verification codes.

Working with operations calendars

Commercial OV and EV renewals intersect with legal approvals. Schedule openssl check certificate expiry reviews at sixty and thirty days on calendars shared with legal, not only with engineering. Missing human gates shows up as surprise expiry even when automation emails exist.

Mainframe and appliance teams may lack OpenSSL on hosts. Jump hosts become the approved place to run s_client against those VIPs. Document approved paths so auditors know evidence was not fabricated on unrelated laptops.

When shipping appliances to customers, factory certificates sometimes expire in warehouses. Run checks before delivery; expired defaults on hardware create painful truck rolls.

Multi-cloud failover drills should log notAfter from both active and standby regions. Teams forget passive regions until DNS flips during real disasters.

SRE error budgets should treat preventable expiry as customer-impacting even when uptime graphs look flat. Reliability culture improves when OpenSSL evidence precedes blameless post-mortems.

Partner white-label domains need checks on both partner-facing and end-customer URLs. Expiry on an obscure admin hostname still breaches contracts when that hostname appears in PDF reports.

Snowflake warehouses ingesting expiry metrics should store raw OpenSSL strings, not only derived day counts. Raw strings help debug parser regressions and daylight-saving edge cases.

Executive summaries should cite hostname, environment, check type (file or live), and notAfter in one sentence. Brevity with evidence beats paragraphs of adjectives.

Finally, teach interns that openssl check certificate expiry is permission to ask questions early. Junior staff who ping seniors at twenty-one days prevent heroes at midnight on day zero.

Plain-language summary

OpenSSL remains the lowest-common-denominator tool for certificate dates across Linux, macOS, and Windows shells. Teams standardize on a handful of commands so every responder speaks the same evidence language during bridges.

Certificate dates use GMT strings that read unfamiliar to people who think in local timezones. Convert deliberately before telling executives how many days remain, especially near midnight boundaries in UTC.

File checks and network checks answer different questions. Articulate which question you asked before sharing results, or listeners assume the wrong fix path.

Commercial support contracts sometimes ask for OpenSSL transcripts before escalating to CAs. Keep templates in your ticket system so engineers paste consistent evidence packages.

Automation should wrap OpenSSL failures with actionable hints: unreachable host, unparsable PEM, expired output, or warning threshold crossed. Raw exit codes alone slow incident response.

OpenSSL cannot renew certificates; it only reports state. Pair every diagnostic guide with renewal ownership in your service catalog so diagnostics never orphan into endless loops.

Seasoned operators still run manual checks when automation disagrees with customer reports. Trust but verify remains valid even in highly automated estates.

When executives ask whether OpenSSL is enough, answer that it is necessary but not sufficient for customer experience. External vantage completes the story your laptop cannot tell alone.

Run quarterly tabletop exercises where responders derive only from OpenSSL transcripts posted in chat. Speed improves when everyone reads the same output format without tribal mnemonics.

Publish a single internal permalink listing supported OpenSSL versions on jump hosts. Version drift causes otherwise inexplicable parsing differences between teams during joint incidents.

Reward tickets that include both file-based and live output with praise in retrospective meetings. Cultural incentives outperform mandatory fields that people fill with placeholders.

Document escalation thresholds: fewer than seven days remaining triggers automatic renewal owner page, regardless of business unit silos.

Maintain a living list of alternate ports per product line. Rotation during on-call weeks distributes knowledge that would otherwise die with one senior engineer.

Offer office hours where anyone can bring a laptop and learn OpenSSL interactively. Self-serve learning reduces duplicate Slack questions during renewal season peaks.

Safety teams reviewing supplier risk should request recent OpenSSL transcripts alongside penetration test PDFs. Expiry evidence is cheap to produce and high impact when missing.

Platform newsletters can feature one openssl command monthly with a short story of how it prevented an outage. Repetition builds literacy without mandatory training fees.

Treat near-miss incidents where files looked fresh but live dates were old as case studies in onboarding decks. Stories stick better than abstract policy language.

Add a recurring calendar event thirty days before peak sales seasons that forces live OpenSSL checks on storefront hostnames, even when automation shows green.

Rotate which storefront hostname appears on that calendar so every listener eventually receives human attention each year.