SSL Certificate Check Command Generator

Q: How do I see how many days until a domain cert expires?

echo | openssl s_client -servername domain -connect domain:443 2>/dev/null | openssl x509 -noout -dates prints notBefore and notAfter. Subtract today from notAfter to get the remaining days.

Q: What happens with an incomplete cert chain?

s_client shows only the leaf cert by default. Add -showcerts for the full chain. If the server doesn't serve the intermediate cert, clients report a chain error or distrust. Use openssl s_client -showcerts to inspect.

Q: Why use the -servername flag?

-servername sets SNI (Server Name Indication); multi-domain and wildcard certs are selected by SNI. Without it you may get the default cert or an IP cert, checking the wrong target.

Q: How do I auto-alert on cert expiry?

Run openssl daily in cron to get notAfter, and alert (mail/webhook) when the remaining days fall below a threshold. The tool generates this check command; pair it with the crontab generator for scheduling.

Honest note: a browser cannot query a domain's cert for you (that needs a TLS handshake, a server-side capability). This tool generates the correct check command + renewal-reminder path — run it on your own machine to get the real expiry date. No fake "click-to-check" promise here.

Generate the expiry check command

Enter a domain; the tool emits the command that fetches the cert and parses its expiry, plus how to read it.

Domain

How to read it

Result	Meaning
`notAfter` < 0 days from now	Cert expired — replace now
< 30 days	Expiring soon — renew (Let's Encrypt auto-renews < 30 days)
< 90 days	Monitor, set a reminder
Normal	Just re-check periodically

Common traps

SNI not set: without -servername you may get the default cert and check the wrong target.
Non-443 port: add -connect domain:port.
Incomplete chain: add -showcerts to see the full chain; a missing intermediate causes chain errors.
Wildcard cert: *.example.com does not cover the example.com apex — need a separate cert or a SAN.

Nginx reverse proxy 502/504 troubleshooting — locating handshake failures from the cert chain
crontab generator — schedule the periodic check

SSL Certificate Check Command Generator

Generate the expiry check command

How to read it

Common traps

Related tutorials