How to Check Your SSL Certificate's Expiration Date
You can check when an SSL certificate expires four ways, from quickest to most thorough: a one-line openssl command that prints the notAfter date, a short script that computes days remaining, an online checker like Qualys SSL Labs, or continuous monitoring that watches every certificate across your domains. Manual checks are fine for one-off audits but miss certificates you forgot you had and failures other than expiry - which is why ongoing monitoring is the real fix.
Checking when your SSL certificate expires is a small task that prevents a large class of outages. This guide covers four ways to check, from quickest (a single shell command) to most thorough (continuous monitoring that watches every certificate across all your domains).
Method 1: One-line shell command
Fastest. Works on any system with OpenSSL installed (macOS, most Linux distributions, Windows with WSL).
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -datesOutput looks like:
notBefore=Apr 3 00:00:00 2026 GMT
notAfter=Jul 2 23:59:59 2026 GMT
The notAfter date is your expiration. If it's already in the past, your certificate is expired.
For just the expiration date in a more human format:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -enddateMethod 2: Days until expiration
If you want to know exactly how many days are left:
expiry=$(echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
expiry_epoch=$(date -d "$expiry" +%s)
now_epoch=$(date +%s)
echo "$(( (expiry_epoch - now_epoch) / 86400 )) days until expiry"Useful for ad-hoc audits. Drop the command in a script if you want to spot-check a list of domains.
Method 3: Online checkers
If you don't have a terminal handy, several free web tools work:
- Qualys SSL Labs - most comprehensive. Checks expiration plus dozens of other configuration issues. Takes about a minute.
- SSLshopper - quicker, simpler. Just expiration and basic chain info.
- This site's free scanner - checks expiration and the full set of failure modes (chain, cipher, hostname, revocation, vulnerabilities).
Method 4: Continuous monitoring (the real fix)
Manually checking certificates is fine for one-off audits. For ongoing visibility, continuous monitoring catches what manual checks miss. The reasons it matters:
- You forget. If checking expiration is a manual task, you'll skip it during busy weeks. The renewal slips. The outage happens.
- You don't know all your certificates. Most teams underestimate their certificate count by 2–3x. Marketing subdomains, internal admin tools, mobile app certificate pins, vendor-managed endpoints - they all have certificates that nobody on your team is consciously tracking.
- Expiry isn't the only failure mode. Chain breaks, weak ciphers, hostname mismatches, revocations - these all break SSL without changing the expiration date. Manual expiry checks miss them entirely.
Stop this from happening again
TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes - chain breaks, weak ciphers, hostname mismatches, risky EKUs, and distrust events - that keep a site from opening in every browser. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.
Where the expiration date lives
Some quick reference for what you're actually checking:
- Every X.509 certificate has a
notBeforeandnotAfterfield - the validity window. - Once
notAfteris in the past, browsers reject the connection with "your certificate has expired." - Validity periods are shrinking. By March 2027, the maximum public-cert validity drops to 100 days (down from 397 in 2024). By March 2029, it drops to 47 days. The renewal cadence is getting tighter - manual tracking gets correspondingly harder.
What to check besides expiration
Once you're looking at a certificate, here are five other things worth checking while you have it open:
- Chain length - should be 2 or 3 certificates (leaf + intermediate + sometimes root). A bare leaf means missing intermediates.
- SAN list - confirm every hostname you serve is on the list.
openssl x509 -noout -text | grep -A1 "Subject Alternative Name". - Issuer - confirm it's a CA you actually use. Anything unexpected here is worth investigating.
- Cipher and protocol - confirm TLS 1.2 minimum, no weak ciphers.
nmap --script ssl-enum-ciphers -p 443 example.com. - OCSP / revocation status - confirm the certificate hasn't been revoked since issuance.
Related reading
Frequently asked questions
- How do I check when my SSL certificate expires?
- Run 'echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates' and read the notAfter line - that is the expiration date. If you do not have a terminal, use an online checker like Qualys SSL Labs or a free SSL scanner, which also report expiry.
- How do I check the SSL expiration date from the command line?
- Use openssl: pipe 'openssl s_client -connect example.com:443' into 'openssl x509 -noout -enddate' to print just the expiry, or '-dates' for both the start and end. To compute days remaining, convert the enddate to epoch seconds and subtract the current time divided by 86400.
- How many days until my certificate expires?
- Extract the enddate with openssl, convert it to epoch seconds with 'date -d', subtract the current epoch time, and divide by 86400 to get days. This is handy for ad-hoc audits, but for ongoing coverage a monitor that tracks every certificate and alerts you in advance is more reliable than a manual script.
- Is checking the expiry date enough?
- For a one-off audit, yes. For ongoing safety, no: manual checks get skipped during busy weeks, they miss certificates nobody is consciously tracking, and expiry is only one failure mode - chain breaks, weak ciphers, hostname mismatches, and revocation all break TLS without changing the expiry date. Continuous monitoring covers those.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.