SSL Certificate Expiry: 3 Linux Commands to Check Dates
Nov 02, 2026
-
by John Britto
-
-
2 min read
Quick Linux Tip #114 :
Question: How do I check SSL certificate expiry dates on all my servers in bulk?
Try: for host in server1.example.com server2.example.com api.example.com; do echo -n "$host: "; echo | openssl s_client -connect $host:443 -servername $host 2>/dev/null | openssl x509 -noout -enddate; done
Info: echo | openssl s_client makes a quick TLS handshake. -servername sends SNI (needed for virtual hosts). Piped to x509 to extract specific info without full dump.
Examples:
$ openssl x509 -in cert.pem -noout -dates # Inspect expiration dates of a local certificate file
$ echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -text # Dump complete certificate details
$ nmap --script ssl-cert -p 443 host # Scan and check certificates using Nmap
Note: Automate expiry checks via cron with mail alerts 30 days prior. For Let's Encrypt, use certbot renew with deployment hooks.
LinuxTeck.com
linuxteck:~$ for host in server1.example.com server2.example.com api.example.com; do echo -n "$host: "; echo | openssl s_client -connect $host:443 -servername $host 2>/dev/null | openssl x509 -noout -enddate; done
server1.example.com: notAfter=Dec 15 23:59:59 2026 GMT
server2.example.com: notAfter=Jan 23 15:34:12 2027 GMT
api.example.com: notAfter=Nov 10 08:12:45 2026 GMT
linuxteck:~$ echo | openssl s_client -connect api.example.com:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates
subject=CN = api.example.com
issuer=C = US, O = Let's Encrypt, CN = R3
notBefore=Aug 12 08:12:45 2026 GMT
notAfter=Nov 10 08:12:45 2026 GMT
linuxteck:~$
About John Britto
John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.
View all posts by John Britto →
Leave a Reply