Check cert expiry

Print notBefore and notAfter dates

openssl x509 -in cert.pem -noout -dates
tool
openssl27 commands
tags
opensslsecurity

More openssl commands

  • Verify cert against CA
    openssl verify -CAfile ca.pem cert.pem

    Check certificate chain against a CA bundle

  • Check cert matches key
    diff <(openssl x509 -pubkey -noout -in cert.pem) <(openssl pkey -pubout -in key.pem) && echo 'MATCH'

    Confirm the cert and private key are a pair

  • Convert PEM to PKCS#12
    openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca.pem -out bundle.p12 -name myalias

    Package cert + key + CA into a .p12 file

  • Extract cert from PKCS#12
    openssl pkcs12 -in bundle.p12 -nokeys -out cert.pem && openssl pkcs12 -in bundle.p12 -nocerts -nodes -out key.pem

    Split .p12 into separate cert and key PEM files

  • Check live TLS cert
    echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject -issuer

    Show expiry and issuer of a live TLS certificate

all 27 openssl commands