TIL: Checking SSL Certificate Expiry With openssl

SSL certificates expire. Finding out on the day it happens is the worst time to learn. openssl checks expiry from the terminal.

openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null | openssl x509 -noout -dates

The s_client command connects to the TLS endpoint. Piped through x509 it extracts the certificate dates. Output shows notBefore and notAfter.

openssl s_client -connect api.example.com:443 2>/dev/null | openssl x509 -noout -enddate

Just the expiry date. Easier to parse in a script.

echo | openssl s_client -connect api.example.com:443 2>/dev/null | openssl x509 -noout -checkend 2592000

Check if the certificate expires within the next 30 days (2592000 seconds). Exit code 0 means it is valid, 1 means it expires soon or has expired.

Can I monitor multiple endpoints?

Wrap the check in a loop over a list of domains. Pipe the results into a notification command for expiring certs.

Does this work with self-signed certs?

Yes. The same commands work. Add -CAfile to verify against a custom CA cert.