DE

↑ ↓ select, Enter open, Esc close

Check the SSL certificate expiration date of a website

harmlessSSL and certificatesalle
Adjust the values, the command updates live
user@server
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

Opens a TLS connection, passes the delivered certificate to openssl x509 and shows notBefore and notAfter. The -servername option sends the hostname via SNI, without it a server with many domains (such as Plesk) often returns the default certificate instead of the right one. It checks what visitors actually see, not what is stored on disk.

Note: For other ports such as 8443 or 993, simply adjust the port number.

Also searched as

  • check ssl certificate expiration date command line
  • when does my ssl certificate expire
  • openssl show certificate dates
  • check if let's encrypt certificate expired

Related one-liners

All in SSL and certificates

Check whether a certificate expires within the next days

#openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -checkend $(( 30 * 86400 )) && echo "noch gültig" || echo "läuft bald ab"
harmlessSSL and certificates

Show the expiry date and subject of a certificate file

#openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -subject -issuer -enddate
harmlessSSL and certificates

Check whether a private key matches a certificate

#openssl x509 -noout -modulus -in /etc/ssl/certs/example.com.crt | openssl md5 && openssl rsa -noout -modulus -in /etc/ssl/private/example.com.key | openssl md5
harmlessSSL and certificates

Check whether a website's certificate is trusted

$openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com </dev/null 2>/dev/null | grep "Verify return code"
harmlessSSL and certificates

Create a self-signed certificate for testing

$openssl req -x509 -newkey rsa:2048 -nodes -days 365 -keyout test.key -out test.crt -subj "/CN=test.example.com" -addext "subjectAltName=DNS:test.example.com"
cautionSSL and certificates

Read all domains of a certificate (SAN)

$openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName
harmlessSSL and certificates

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.