How to check SSL certificate expiration

1. Check a live website
2. Check a certificate file on disk
3. Check whether it expires within N days

An expired certificate takes a site down hard — every visitor sees your connection is not private. Checking the expiry date takes one command.

#Check a live website

Connect to the site and read the validity dates straight from the certificate it serves:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

You'll get the start and end of the validity window:

notBefore=Mar  1 00:00:00 2026 GMT
notAfter=May 30 23:59:59 2026 GMT

To see only the expiry date, swap -dates for -enddate:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -enddate

#Check a certificate file on disk

If you have the certificate as a local file:

openssl x509 -in certificate.pem -noout -enddate

This works on any PEM or CRT file. For other formats, see converting certificate formats first.

#Check whether it expires within N days

The -checkend flag is built for scripts and monitoring. It takes a number of seconds and exits non-zero if the certificate expires within that window. This checks for the next 30 days (30 × 86400 = 2592000 seconds):

openssl x509 -in certificate.pem -noout -checkend 2592000

echo $?   # 0 = still valid, 1 = expires within 30 days

Wire that exit code into a cron job or a monitoring check and you'll get warned before a certificate ever lapses. If your certificate is valid but the connection still fails, the cause is often a missing certificate chain rather than the expiry date.