DE

↑ ↓ select, Enter open, Esc close

Show the expiry date and subject of a certificate file

harmless rootSSL and certificatesalle
Adjust the values, the command updates live
root@server
openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -subject -issuer -enddate

Reads a certificate file in PEM format and prints the subject, issuer and notAfter. Useful to see quickly which certificate is meant for what and for how long, before installing it or when sorting through a collection of files. Use -text instead of the individual options to see all details.

Note: Root is only needed if the file is protected, as under /etc/letsencrypt/. For DER files, add -inform der.

Also searched as

  • check certificate file expiration
  • crt file expiry date openssl
  • which domain is this certificate for
  • show pem certificate details

Related one-liners

All in SSL and certificates

Check the SSL certificate expiration date of a website

$openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
harmlessSSL and certificates

Check whether a certificate expires within the next days

#openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -checkend $(( 30 * 86400 )) && echo "noch gültig" || echo "läuft bald ab"
harmlessSSL and certificates

Check whether a private key matches a certificate

#openssl x509 -noout -modulus -in /etc/ssl/certs/example.com.crt | openssl md5 && openssl rsa -noout -modulus -in /etc/ssl/private/example.com.key | openssl md5
harmlessSSL and certificates

Check whether a website's certificate is trusted

$openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com </dev/null 2>/dev/null | grep "Verify return code"
harmlessSSL and certificates

Convert a PFX file to PEM with certificate and key

$openssl pkcs12 -in example.com.pfx -out example.com.pem -nodes
cautionSSL and certificates

Create a self-signed certificate for testing

$openssl req -x509 -newkey rsa:2048 -nodes -days 365 -keyout test.key -out test.crt -subj "/CN=test.example.com" -addext "subjectAltName=DNS:test.example.com"
cautionSSL and certificates

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.