How to Check SSL Certificate Expiration: Browser, OpenSSL, curl & Online

Method 1: Check in your browser (fastest glance)

Best when you just need one site's date right now:

• Chrome / Edge: click the tune icon left of the URL → “Connection is secure” → “Certificate is valid”. The “Expires on” value is the date you want.
• Firefox: click the padlock → “Connection secure” → “More information” → “View Certificate”. Look for “Not After”.
• Safari: click the padlock → “Show Certificate”. Validity dates are at the top.

Limitation: the browser shows one certificate at a time and nothing about the rest of your fleet. Fine for a spot check, useless for operations.

Method 2: Check with OpenSSL (terminal, scriptable)

The standard way to read a live certificate from any server. Works on Linux, macOS, and Windows (with OpenSSL installed):

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -enddate
# notAfter=May 23 12:00:00 2027 GMT

The -servername flag sets SNI — required whenever a server hosts multiple sites on one IP. To see both dates, swap -enddate for -dates. To test “expires within 30 days” in a cron job:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -checkend 2592000
# "Certificate will not expire" (exit 0) or "Certificate will expire" (exit 1)

Gotcha: OpenSSL queries whichever backend IP your DNS resolves to. Behind a CDN or load balancer, repeat the check per origin or use a monitor that validates every endpoint — see what breaks when a certificate expires.

Method 3: Check with curl (quick + chain info)

curl prints certificate dates as part of verbose TLS output — handy when you already live in the terminal:

curl -vI https://yourdomain.com 2>&1 | grep -E "expire|start date|issuer|subject"
# *  expire date: May 23 12:00:00 2027 GMT
# *  issuer: C=US; O=Let's Encrypt; CN=R11

Method 4: Free online SSL checker (no terminal)

Paste any domain into Certack's free checker on the homepage — no signup. You get issuer, validity dates, signature algorithm, and the full SAN list instantly, including the complete chain (leaf → intermediate → root), which browsers and one-liners don't spell out.

Online checkers are also the easiest way to verify a fix after renewal: re-run the check and confirm the new notAfter date is live on every endpoint before closing the incident.

Checking once is not monitoring

Manual checks answer “what is the date today”. They don't warn you when a renewal silently fails, when a teammate deploys the wrong cert, or when a short-lived certificate (see how certificate lifetimes are shrinking) needs replacing eight times a year. That's the gap automated monitoring fills: daily checks, full-chain validation, and alerts at 60, 30, 14, 7, and 1 days before expiry on email, Slack, PagerDuty, and six more channels.

Add your first two sites free — it takes about 30 seconds, and the first check runs immediately.