Check when an SSL certificate expires from the terminal

Before the browser warning does it for you.

SNP 113 #531 Filed cmd ssl linux

shell
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
shell
notBefore=Jun  1 00:00:00 2026 GMT
notAfter=Aug 30 23:59:59 2026 GMT

The -servername matters on hosts that serve several sites, otherwise you get the default certificate. Add -issuer and -subject to see who issued it and for which names.

For a certificate file on disk:

shell
openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -enddate

With certbot, sudo certbot certificates lists all of them with their days left.