Checking an SSL certificate's expiration date

Finding out when a certificate expires takes a few seconds, as long as you know the right method. Here are the four main ones, from simplest to most technical.

1. With the online checker

The fastest way: enter the domain in the free SSL checker. You get:

• the expiration date and the number of days remaining;
• the authority that issued the certificate;
• the names covered and whether they match the requested domain;
• the negotiated TLS protocol and the key size.

Nothing to install, and the test reflects exactly what your visitors see.

2. In the browser

Chrome / Edge: click the icon to the left of the address, then Connection is secure → Certificate is valid. The dates appear under Validity Period (Issued On and Expires On).

Firefox: click the padlock, then Connection secure → More information → View Certificate.

Safari: click the padlock, then Show Certificate.

Limitation: you only see the certificate served to your connection. Behind a load balancer, another server may be serving a different certificate.

3. From the command line with OpenSSL

Ideal for scripts and headless servers:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates

Output:

notBefore=Sep 18 08:12:44 2026 GMT
notAfter=Dec 17 08:12:43 2026 GMT

notAfter is the expiration date. A few useful variations:

# Issuer, subject and expiration date
... | openssl x509 -noout -issuer -subject -enddate

# Names covered (OpenSSL 1.1.1 or later)
... | openssl x509 -noout -ext subjectAltName

# Non-zero exit code if the certificate expires in less than 30 days
... | openssl x509 -noout -checkend 2592000

The -servername option matters: without it, a server hosting several sites may return another domain's certificate.

With curl, it's even shorter:

curl -vI https://example.com 2>&1 | grep -i "expire"

4. Directly on the server

To read a certificate file (.pem or .crt):

openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -enddate

If you use Certbot:

sudo certbot certificates

Be careful: the file on disk isn't necessarily the one the web server actually serves. After a renewal, Nginx or Apache must be reloaded. So always check from the outside as well, with method 1 or 3.

Checking a certificate isn't enough: you need to monitor it

All of these methods give you a snapshot at a given moment. To stop having to think about it, add your domains to SSL Expiration Reminder: the date is checked automatically every day, and you get an alert 30, 15, 7, 3 or 1 day before expiry, or as soon as a certificate becomes invalid.