Check a Website's Certificate Expiry Date
Use openssl s_client piped to x509 -dates to print notBefore and notAfter of a live TLS certificate.
Run the s_client command above — the notAfter line is the expiry date; compare it with today's date.
01Command
Command
$ echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates02What it does
The pipeline connects to the server's TLS port, receives its certificate, and prints only the validity dates instead of the full dump. An already-expired notAfter date explains 'certificate is not trusted' browser warnings for sites you otherwise trust. Add `-endDate` instead of `-dates` if you want just the expiry, or inspect a saved .pem file with `openssl x509 -in cert.pem -noout -dates`.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- openssl — cryptography toolkit (macOS man page)Evidence: Documents openssl s_client for connecting to a TLS server and x509 -noout -dates for printing a certificate's validity window.
Last verified: 2026-09-18 · Category: Security & Privacy