{"id":15457,"date":"2023-02-10T21:08:32","date_gmt":"2023-02-10T18:08:32","guid":{"rendered":"https:\/\/kifarunix.com\/?p=15457"},"modified":"2024-03-10T08:17:05","modified_gmt":"2024-03-10T05:17:05","slug":"check-ssl-certificate-expiry-date-from-certificate-file","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/check-ssl-certificate-expiry-date-from-certificate-file\/","title":{"rendered":"Check SSL Certificate Expiry Date from Certificate File"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1063\" height=\"595\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/check-ssl-certificate-expiry-from-crt-file.png\" alt=\"Check SSL Certificate Expiry Date from Certificate File\" class=\"wp-image-15477\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/check-ssl-certificate-expiry-from-crt-file.png?v=1676052377 1063w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/02\/check-ssl-certificate-expiry-from-crt-file-768x430.png?v=1676052377 768w\" sizes=\"(max-width: 1063px) 100vw, 1063px\" \/><\/figure>\n\n\n\n<p>How to check SSL certificate expiration date command line? In this guide, you will learn how to check SSL certificate expiry date from the certificate file itself. SSL (Secure Socket Layer)\/TLS (Transport Layer Security) certificates, are used to encrypt data exchanged between a website and its users. Thus being able to know the expiration date is important in protecting sensitive information such as passwords, credit card numbers, and other personal information from being intercepted by malicious actors.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Checking SSL Certificate Validity from Certificate File<\/h2>\n\n\n\n<p>So, how can you check SSL certificate expiry date\/validity from the certificate file itself? Well, there are various ways in which you can monitor SSL\/TLS certificate expiration date. For example, you can;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/monitor-ssl-tls-certificate-expiry-with-prometheus-and-grafana\/\" target=\"_blank\" rel=\"noreferrer noopener\">Monitor SSL\/TLS Certificate Expiry with Prometheus and Grafana<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/monitor-ssl-tls-certificates-expiry-with-nagios\/\" target=\"_blank\" rel=\"noreferrer noopener\">Monitor SSL\/TLS Certificates Expiry with Nagios<\/a><\/p>\n\n\n\n<p>However, there are some instances when maybe you just have the SSL\/TLS certificate file and you want to find out the expiration date. This is where <strong><code>openssl<\/code><\/strong> command comes in handy.<\/p>\n\n\n\n<p>openssl is a general-purpose SSL\/TLS cryptographic command line tool that can be used to perform cryptographic operations such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>creating RSA, DH, and DSA key parameters;<\/li>\n\n\n\n<li>creating X.509 certificates, CSRs, and CRLs;<\/li>\n\n\n\n<li>calculating message digests;<\/li>\n\n\n\n<li>encrypting and decrypting with ciphers;<\/li>\n\n\n\n<li>testing SSL\/TLS clients and servers;<\/li>\n\n\n\n<li>handling S\/MIME signed or encrypted mail;<\/li>\n\n\n\n<li>and even checking the expiration dates of the SSL\/TLS certificate files.<\/li>\n<\/ul>\n\n\n\n<p>That being said, how can you use openssl command to check SSL certificate expiry date from certificate file?<\/p>\n\n\n\n<p>SSL\/TLS certificates uses <a href=\"https:\/\/www.openssl.org\/docs\/man3.0\/man7\/x509.html\" target=\"_blank\" rel=\"noreferrer noopener\">X.509 digital certificates standard<\/a>. Thus, if you want to use <code><strong>openssl<\/strong><\/code> command to check SSL certificate expiry date from the certificate file, you need to pass the x509 option;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl x509 &#91;options]<\/code><\/pre>\n\n\n\n<p>You can pass other options that enables you to via the status of the certificate file. To get the options, check the help information;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openss x509 -help<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nUsage: x509 [options]\nValid options are:\n -help                      Display this summary\n -inform format             Input format - default PEM (one of DER or PEM)\n -in infile                 Input file - default stdin\n -outform format            Output format - default PEM (one of DER or PEM)\n -out outfile               Output file - default stdout\n -keyform PEM|DER|ENGINE    Private key format - default PEM\n -passin val                Private key password\/pass-phrase source\n -serial                    Print serial number value\n -subject_hash              Print subject hash value\n -issuer_hash               Print issuer hash value\n -hash                      Synonym for -subject_hash\n -subject                   Print subject DN\n -issuer                    Print issuer DN\n -email                     Print email address(es)\n -startdate                 Set notBefore field\n -enddate                   Set notAfter field\n -purpose                   Print out certificate purposes\n -dates                     Both Before and After dates\n -modulus                   Print the RSA key modulus\n -pubkey                    Output the public key\n -fingerprint               Print the certificate fingerprint\n -alias                     Output certificate alias\n -noout                     No output, just status\n -nocert                    No certificate output\n -ocspid                    Print OCSP hash values for the subject name and public key\n -ocsp_uri                  Print OCSP Responder URL(s)\n -trustout                  Output a trusted certificate\n -clrtrust                  Clear all trusted purposes\n -clrext                    Clear all certificate extensions\n -addtrust val              Trust certificate for a given purpose\n -addreject val             Reject certificate for a given purpose\n -setalias val              Set certificate alias\n -days int                  How long till expiry of a signed certificate - def 30 days\n -checkend intmax           Check whether the cert expires in the next arg seconds\n                            Exit 1 if so, 0 if not\n -signkey val               Self sign cert with arg\n -x509toreq                 Output a certification request object\n -req                       Input is a certificate request, sign and output\n -CA infile                 Set the CA certificate, must be PEM format\n -CAkey val                 The CA key, must be PEM format; if not in CAfile\n -CAcreateserial            Create serial number file if it does not exist\n -CAserial val              Serial file\n -set_serial val            Serial number to use\n -text                      Print the certificate in text form\n -ext val                   Print various X509V3 extensions\n -C                         Print out C code forms\n -extfile infile            File with X509V3 extensions to add\n -rand val                  Load the file(s) into the random number generator\n -writerand outfile         Write random data to the specified file\n -extensions val            Section from config file to use\n -nameopt val               Various certificate name options\n -certopt val               Various certificate text options\n -checkhost val             Check certificate matches host\n -checkemail val            Check certificate matches email\n -checkip val               Check certificate matches ipaddr\n -CAform PEM|DER            CA format - default PEM\n -CAkeyform PEM|DER|ENGINE  CA key format - default PEM\n -sigopt val                Signature parameter in n:v form\n -force_pubkey infile       Force the Key to put inside certificate\n -next_serial               Increment current certificate serial number\n -clrreject                 Clears all the prohibited or rejected uses of the certificate\n -badsig                    Corrupt last byte of certificate signature (for test)\n -*                         Any supported digest\n -subject_hash_old          Print old-style (MD5) issuer hash value\n -issuer_hash_old           Print old-style (MD5) subject hash value\n -engine val                Use engine, possibly a hardware device\n -preserve_dates            preserve existing dates when signing\n<\/code><\/pre>\n\n\n\n<p>So our options of interest in checking SSL expiry date from the certificate file is;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><code>-enddate<\/code><\/strong>: which shows expiry date of the certificate<\/li>\n\n\n\n<li><strong><code>-in infile<\/code><\/strong>: specify the file you want to check.<\/li>\n<\/ul>\n\n\n\n<p>So, for example, let&#8217;s assume we have an SSL cerificate file, <strong><code>kifarunix.com.crt<\/code><\/strong>, then you can check expiry date by running;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl x509 -enddate -in kifarunix.com.crt<\/code><\/pre>\n\n\n\n<p>When it comes to SSL\/TLS certificate files, most commonly, they are in PEM (Privacy Enhanced Mail) format, represented as ASCII text with common file extensions such as <code>.pem<\/code>, <code>.crt<\/code>, <code>.cer<\/code>, or <code>.key<\/code> file extension.<\/p>\n\n\n\n<p>Sample output of the command above;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n<strong>notAfter=May 25 23:59:59 2023 GMT<\/strong>\n-----BEGIN CERTIFICATE-----\nMIIFODCCBN6gAwIBAgIQCjdlgQ3agI7H1Otstj8MbjAKBggqhkjOPQQDAjBKMQsw\nCQYDVQQGEwJVUzEZMBcGA1UEChMQQ2xvdWRmbGFyZSwgSW5jLjEgMB4GA1UEAxMX\nQ2xvdWRmbGFyZSBJbmMgRUNDIENBLTMwHhcNMjIwNTI1MDAwMDAwWhcNMjMwNTI1\nMjM1OTU5WjB1MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQG\nA1UEBxMNU2FuIEZyYW5jaXNjbzEZMBcGA1UEChMQQ2xvdWRmbGFyZSwgSW5jLjEe\nMBwGA1UEAxMVc25pLmNsb3VkZmxhcmVzc2wuY29tMFkwEwYHKoZIzj0CAQYIKoZI\nzj0DAQcDQgAEeAbRxvqt6Q+perH7k1nFVZxuUlAj5j39ov0MQurwzIVgw9ozEryE\nn2Q3Ta4YXmLjB4Ap1nI3bqcRtFwCU1LrzKOCA3kwggN1MB8GA1UdIwQYMBaAFKXO\nN+rrsHUOlGeItEX62SQQh5YfMB0GA1UdDgQWBBS3985hvwLoLud6u87feJ+lYe9M\nnjBABgNVHREEOTA3gg1raWZhcnVuaXguY29tgg8qLmtpZmFydW5peC5jb22CFXNu\naS5jbG91ZGZsYXJlc3NsLmNvbTAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYI\nKwYBBQUHAwEGCCsGAQUFBwMCMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6Ly9jcmwz\nLmRpZ2ljZXJ0LmNvbS9DbG91ZGZsYXJlSW5jRUNDQ0EtMy5jcmwwN6A1oDOGMWh0\ndHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9DbG91ZGZsYXJlSW5jRUNDQ0EtMy5jcmww\n...\n<\/code><\/pre>\n\n\n\n<p>As you can see, the expiry date is given by;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>notAfter=May 25 23:59:59 2023 GMT<\/strong><\/code><\/pre>\n\n\n\n<p>You can also pass the <strong><code>-noout<\/code><\/strong> option to suppresses the output of the command and just print the expiry date.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl x509 -enddate -in kifarunix.com.crt -noout<\/code><\/pre>\n\n\n\n<p>Output;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>notAfter=May 25 23:59:59 2023 GMT<\/code><\/pre>\n\n\n\n<p>Well, you can also connect to the site and check SSL expiry directly from the command line;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl s_client -connect kifarunix.com:443 -showcerts | openssl x509 -enddate -noout<\/code><\/pre>\n\n\n\n<p>And that is it on how to check SSL certificate expiry date from the certificate file itself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/create-locally-trusted-ssl-certificates-with-mkcert-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">Create Locally Trusted SSL Certificates with mkcert on Ubuntu 20.04<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to check SSL certificate expiration date command line? In this guide, you will learn how to check SSL certificate expiry date from the certificate<\/p>\n","protected":false},"author":10,"featured_media":15477,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,34,1187],"tags":[6353,6358,6356,6355,6357,6354],"class_list":["post-15457","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-security","category-ssl-tls","tag-check-ssl-certificate-expiry-date-from-certificate-file","tag-how-to-check-ssl-certificate-expiration-date","tag-openss-endate-option","tag-openssl-enddate","tag-openssl-check-expiry-date","tag-openssl-x509-check-expiry","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15457"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=15457"}],"version-history":[{"count":7,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15457\/revisions"}],"predecessor-version":[{"id":20698,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/15457\/revisions\/20698"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/15477"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=15457"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=15457"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=15457"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}