How to Check SSL Certificate Expiration Date in Linux

To check SSL certificate expiration date in Linux, users can employ simple OpenSSL commands in their terminal. The process of checking SSL certificate expiration date in Linux requires basic command line knowledge. The primary method uses OpenSSL: openssl s_client -connect website.com:443 2>/dev/null | openssl x509 -noout -dates.

Linux administrators who need to check SSL certificate expiration date can also use curl -vI https://website.com. These built-in tools make it easy to check SSL certificate expiration date in Linux systems, ensuring timely certificate renewals and maintaining secure website connections.

Why Monitor SSL Certificates in Linux?

SSL certificates expire every 1-2 years, and missing renewal deadlines causes:

Linux provides powerful tools to check certificate expiration date in Linux before issues occur.

A Step-by-Step Guide to View SSL Certificate Expiration Date in Linux

Method 1: Using OpenSSL (Most Common)

The openssl check certificate expiration date command works on all Linux distributions:

openssl x509 -enddate -noout -in /path/to/certificate.pem

This displays the ssl certificate expiry date in “notAfter=YYYY-MM-DD” format.

Method 2: Checking Remote Servers

To linux check certificate expiration for live websites:

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

This shows both issuance and certificate expiration dates without saving files.

Method 3: Using cURL for Quick Checks

For a faster check SSL certificate expiration date in Linux:

curl -Iv https://example.com 2>&1 | grep "expire date"

This extracts just the expiry date from the SSL handshake.

Method 4: Automated Monitoring with Certbot

The certbot check expiration command helps manage Let’s Encrypt certificates:

certbot certificates

This lists all certificates with their ssl certificate expiry dates and renewal status.

Method 5: Checking Certificate Stores

Linux systems store trusted certificates in:

Use this to check certificate validity:

ls -l /etc/ssl/certs/ | grep -i "your_certificate"

Method 6: Creating Expiry Alerts

Automate monitor certificate expiration with this bash script:

#!/bin/bash
DOMAIN="example.com"
EXPIRY=$(echo | openssl s_client -connect $DOMAIN:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
echo "SSL certificate for $DOMAIN expires on: $EXPIRY"

Troubleshooting Common Issues

1. “Certificate Expired” Error

Renew immediately using:

sudo certbot renew

2. “Self-Signed Certificate” Warning

Add your CA to the trust store:

sudo cp your_cert.pem /usr/local/share/ca-certificates/
sudo update-ca-certificates

3. “Invalid Date” Errors

Ensure your system clock is synchronized:

sudo ntpdate pool.ntp.org

Advanced: Checking Multiple Domains

For bulk check website SSL certificate expiry:

for domain in google.com github.com example.com; do
  echo -n "$domain: "
  echo | openssl s_client -connect $domain:443 2>/dev/null | openssl x509 -noout -enddate
done

Final Thoughts

Monitoring SSL certificate expiration dates in Linux is crucial for maintaining secure, uninterrupted web services. This guide demonstrated multiple methods—from OpenSSL commands to automated scripts—to check expiry dates efficiently. Whether verifying local certificates or remote servers, Linux provides powerful tools for proactive certificate management.

Set up cron jobs for regular checks and consider tools like Certbot for automated renewals. By staying vigilant with these techniques, you’ll prevent security warnings and downtime. Bookmark these commands for quick troubleshooting and keep your systems secure.

Frequently Asked Questions (FAQs)

How do I check my SSL certificate expiry date?

You can check SSL certificate expiry date using OpenSSL command: openssl s_client -connect domain.com:443 2>/dev/null | openssl x509 -noout -enddate. The command displays the expiration date of the SSL certificate for the specified domain.

How do I check SSL certificate details in Linux?

Use the command: openssl x509 -in certificate.crt -text -noout. This command shows complete certificate information including issuer, validity period, and subject details. You can also view SSL details directly from websites using: curl -vI https://domain.com.

Where is SSL certificate stored in Linux?

SSL certificates are typically stored in /etc/ssl/certs directory on Linux systems. Private keys are stored in /etc/ssl/private directory. Some applications store certificates in their own configuration directories.

How do I know if my SSL certificate is working in Linux?

Test SSL certificate functionality with: curl -v https://your-domain.com. A successful connection shows “SSL certificate verify ok” message. You can also use browsers to check the padlock icon and certificate details.

Can I check multiple SSL certificates expiry dates at once?

Yes, create a script with a list of domains and use: for domain in $(cat domain-list.txt); do openssl s_client -connect $domain:443 2>/dev/null | openssl x509 -noout -enddate; done. This checks multiple certificates automatically.

How to enable automatic SSL certificate expiry notifications?

Set up a cron job with a shell script to check certificate expiry dates. Configure the script to send email alerts when certificates approach expiration. Many monitoring tools like Nagios or Zabbix include SSL expiry checking features.

Priya Mervana

Verified Web Security Experts

Priya Mervana is working at SSLInsights.com as a web security expert with over 10 years of experience writing about encryption, SSL certificates, and online privacy. She aims to make complex security topics easily understandable for everyday internet users.