How do I inspect a certificate file and check whether it expires soon?
OpenSSL x509 can inspect the public certificate file without reading its private key. Its expiry check is useful for monitoring a known certificate file, but it does not prove that the web server is currently serving that file or that the complete chain is trusted.
Before you start
- The actual public certificate path.
- Permission to read that certificate through its parent directories.
Instructions
1. Inspect the certificate metadata
Use cert.pem or another public certificate file, not privkey.pem. The path below is a common Certbot example and must match the certificate name actually present on the server.
sudo openssl x509 -in /etc/letsencrypt/live/app.example.com/cert.pem -noout -subject -issuer -dates -ext subjectAltNamePrints identifying information, validity dates and subject alternative names without printing key material.
2. Check a thirty-day threshold
The threshold is expressed in seconds. Interpret an error opening or parsing the file separately from a valid certificate that is near expiry.
sudo openssl x509 -in /etc/letsencrypt/live/app.example.com/cert.pem -noout -checkend 2592000Returns zero when the certificate remains valid beyond the threshold and nonzero when it expires sooner or cannot be checked.
3. Compare with the live endpoint
If renewal has completed but browsers still see the previous certificate, confirm which file the correct virtual host uses and whether the appropriate service has loaded it. Check any load balancer or CDN that terminates TLS first.
Check the result
- The certificate names and dates are correct, the expiry threshold is understood and the live endpoint serves the intended certificate.
Troubleshooting
- The file is new but the live certificate is old
- Inspect the serving layer and renewal deployment hook. Updating a file does not automatically prove that every TLS endpoint has reloaded it.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.