Check When Your SSL Certificate Expires (One openssl Command)

An expired SSL/TLS certificate takes your site offline for every visitor with a browser warning. One openssl command shows the exact expiry date, and certbot can test that auto-renewal still works.

1. Read the dates from the live server

Replace example.com in both places. notBefore and notAfter are the start and expiry dates.

openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -dates

2. Check a certificate file on the server

If you have the certificate file, read it directly.

openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -enddate

3. Let's Encrypt: test auto-renewal

Certbot renews certificates automatically. A dry run proves renewal will work without changing anything.

sudo certbot renew --dry-run
systemctl list-timers | grep certbot

4. Get warned before it expires

Check monthly, or add the command to a monitoring script. Let's Encrypt certificates last 90 days and renew about 30 days before expiry, so a certificate with under 20 days left usually means renewal is broken.

Free tool: SSL certificate checker

Prefer a browser? The free SSL certificate checker on our security tools page shows the expiry date, issuer and chain for any site. No signup. Open the free SSL certificate checker

FAQ

Why do I need -servername?

It sends SNI, so a server hosting many sites returns the certificate for the domain you asked for, not its default one.

Certbot dry run fails. What is the usual cause?

Port 80 blocked by a firewall, a DNS record that no longer points at the server, or a web server config change. The error message names the domain and the reason.