How to Check SSL Certificate Expiration Dates from the Linux Command Line using openssl

The Danger of Expired Certificates

A forgotten SSL/TLS certificate is one of the most common causes of catastrophic web application downtime. When a certificate expires, modern web browsers will present a massive, terrifying security warning to users, completely blocking access to the site. If the expired certificate belongs to an API endpoint, automated scripts and mobile apps will instantly fail to communicate with the server due to untrusted connections.

While you can check the expiration date manually by clicking the padlock icon in a web browser, system administrators managing headless Linux servers need a way to verify certificates directly from the terminal. The openssl command is the perfect tool for extracting and reading the raw metadata of any live SSL certificate.

The OpenSSL s_client Command

The openssl toolkit includes a diagnostic client tool (s_client) that allows you to initiate an SSL/TLS connection to a remote server, download the certificate chain, and parse the data.

Open your Linux terminal and run the following command, replacing example.com with the domain you want to check. Ensure you include the port number (:443 for standard HTTPS).

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

Understanding the Syntax

This command uses a pipeline to achieve a clean, readable result:

• echo |: The s_client tool expects an interactive session. Piping a blank echo forces the connection to close immediately after the handshake is completed and the certificate is downloaded, rather than hanging indefinitely waiting for input.
• -servername example.com: This is critical. It enables SNI (Server Name Indication). Many modern web servers host multiple domains on the same IP address. SNI tells the server exactly which certificate to present.
• 2>/dev/null: This silently discards all standard error outputs and connection logs, keeping your terminal clean.
• | openssl x509 -noout -dates: This pipes the raw, downloaded certificate into the x509 parser. The -noout flag hides the massive block of base64 text, and the -dates flag tells it to only print the validity timestamps.

Reading the Output

The command will instantly output two lines of text that look like this:

notBefore=Mar 15 12:00:00 2024 GMT
notAfter=Jun 13 12:00:00 2024 GMT

• notBefore: The exact date and time the certificate was issued and became valid.
• notAfter: The exact date and time the certificate will expire.

Checking Local Certificate Files

If you are configuring a web server (like Nginx or Apache) and want to check a .crt or .pem file on your local filesystem before you restart the web service, you don’t need the s_client connection tool. You can parse the local file directly using the -in flag:

openssl x509 -in /etc/ssl/certs/my_domain.crt -noout -dates

By integrating these openssl commands into your bash scripts, you can easily create automated monitoring tools that check your domains daily and alert you weeks before a catastrophic expiration event occurs.