How to check when an SSL certificate expires

Check one certificate in seconds, or a whole list of domains with a short script.

1. In the browser

Click the icon left of the address (padlock or tune icon) → Connection is secure → Certificate is valid (Chrome and Edge) or More information → View Certificate (Firefox). The Expires On / Not After field is the date.

2. OpenSSL (Linux, macOS)

echo | openssl s_client -connect github.com:443 -servername github.com 2>/dev/null | openssl x509 -noout -enddate

Prints notAfter=Nov 29 23:59:59 2026 GMT. Keep -servername: without it, servers that host many sites may send a different certificate. Add -subject -issuer to see who the certificate is for and who issued it.

For monitoring scripts, -checkend answers "does it expire within N seconds?" through the exit code (1 = expires soon):

echo | openssl s_client -connect github.com:443 -servername github.com 2>/dev/null \
  | openssl x509 -noout -checkend $((30*86400)) || echo "expires within 30 days"

3. curl

curl -sv https://github.com -o /dev/null 2>&1 | grep -i "expire date"

Works where curl is built with OpenSSL (most Linux systems). Other TLS backends print the certificate details differently or not at all.

4. A list of domains, with days left

for d in github.com apify.com example.com; do
  end=$(echo | openssl s_client -connect "$d:443" -servername "$d" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
  echo "$d  $end  $(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 )) days"
done

date -d is GNU date (Linux). On macOS, install GNU coreutils and use gdate instead.

Certificate expiry is not domain expiry

A certificate typically lasts 90 days to a year and is renewed by the host, often automatically. The domain registration expires separately, usually after one or more years, and is renewed at the registrar. Check it with RDAP, the modern replacement for WHOIS:

curl -sL https://rdap.org/domain/github.com

Look for the events entry with "eventAction": "expiration".

Hundreds of domains, no script to maintain

Our DNS Lookup & WHOIS Domain Checker on Apify takes a list of domains and returns, per domain, the SSL issuer and days to certificate expiry, the domain's registration and expiry dates, DNS records and SPF / DMARC, with warnings, as CSV, Excel or JSON. Billed per domain. For one domain's DNS and email records, use the free DNS lookup.

Written with AI assistance. Every command was run on Linux (OpenSSL 3, GNU date) against the domains shown on 2026-10-01. The Apify tool is ours; the APIs are free to call directly.