Updated: 18 October 2026 · Applies to: OpenSSL 3.5 on Ubuntu 26.04 (tested against a local test server on 127.0.0.1); the same commands work with OpenSSL 3.x on Ubuntu 24.04, Debian 13, AlmaLinux and Rocky Linux 9 and 10
To print all details of a certificate file, run openssl x509 -in cert.pem -noout -text. For the certificate a live website sends, pipe openssl s_client into openssl x509: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates. The notAfter line is the expiry date, and -checkend 2592000 tells you whether the certificate expires within the next 30 days.
1. Print the full certificate details from a file
openssl x509 -in cert.pem -noout -text
-text prints everything in readable form and -noout leaves out the encoded certificate itself. Lab example (a test certificate for example.com signed by our own lab CA; shortened, the key and signature bytes are left out):
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
14:fd:81:06:13:6a:72:51:81:d8:bd:d3:e9:01:51:55:12:cf:e7:d1
Signature Algorithm: sha256WithRSAEncryption
Issuer: O=Lab Test CA, CN=Lab Test Root
Validity
Not Before: Oct 12 10:04:04 2026 GMT
Not After : Jan 10 10:04:04 2027 GMT
Subject: CN=example.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
...
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:example.com, DNS:www.example.com
...
- Issuer: the certificate authority (CA) that signed it.
- Validity: the certificate is valid between Not Before and Not After (always in GMT).
- Subject and Subject Alternative Name: the names it covers. Browsers match the site name against the SAN list.
- Public-Key: the key type and size.
If the file is in binary DER format (often .der or .cer), add -inform der. For a PFX/PKCS#12 bundle, extract the certificate first: openssl pkcs12 -in site.pfx -nokeys -clcerts | openssl x509 -noout -subject -enddate (it asks for the bundle password). A certificate request (CSR) is read with openssl req -in site.csr -noout -text.
2. Print only the details you need
Lab example with the same test certificate (the output is the same whether OpenSSL reads the file or the certificate a server sends):
$ openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName
subject=CN=example.com
issuer=O=Lab Test CA, CN=Lab Test Root
notBefore=Oct 12 10:04:04 2026 GMT
notAfter=Jan 10 10:04:04 2027 GMT
X509v3 Subject Alternative Name:
DNS:example.com, DNS:www.example.com
$ openssl x509 -in cert.pem -noout -serial -fingerprint -sha256
serial=14FD8106136A725181D8BDD3E901515512CFE7D1
sha256 Fingerprint=67:01:09:93:CA:AA:A3:3D:36:FA:43:8A:49:D9:5F:B9:8E:A6:16:2E:11:92:50:02:02:1A:04:76:70:A6:B5:32
Combine the options in any order. -enddate alone prints just the expiry line, -startdate just the start.
3. Check the certificate of a live server
- Fetch the certificate and print its details:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
- Read the output as in section 2. This shows what the server really sends, which is what visitors get, even if a newer file is waiting on disk because the web server was not reloaded.
What each part does: -connect gives the host and port; -servername sends the name (SNI), so a server with several sites on one IP returns the right certificate. According to the OpenSSL manual, s_client takes the name from -connect when you leave -servername out, but you need it when you connect by IP address. echo | closes the connection straight away, and 2>/dev/null hides the connection log. OpenSSL 3.5 in our test also accepts -no-interactive instead of echo |. If the port is closed, you get BIO_connect:Connection refused instead.
4. Check the expiry date and get a warning in time
$ openssl x509 -in cert.pem -noout -enddate -checkend 2592000 notAfter=Jan 10 10:04:04 2027 GMT Certificate will not expire $ openssl x509 -in cert.pem -noout -checkend 8640000 Certificate will expire
-checkend takes seconds: 2592000 is 30 days and 8640000 is 100 days. The exit code is 0 for "will not expire" and 1 for "will expire", so you can use it in a script or cron job. An expired certificate on our test server gave:
$ echo | openssl s_client -connect 127.0.0.1:8444 -servername example.com 2>/dev/null | openssl x509 -noout -enddate -checkend 0 notAfter=Apr 1 00:00:00 2025 GMT Certificate will expire
To print the days left (Linux date):
end=$(openssl x509 -in cert.pem -noout -enddate | cut -d= -f2) echo $(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))
This printed 89 for our 90-day test certificate. A simple check for a cron job:
host=example.com if echo | openssl s_client -connect "$host:443" -servername "$host" 2>/dev/null | openssl x509 -noout -checkend 2592000 >/dev/null; then echo "$host: valid for at least 30 more days" else echo "$host: expires within 30 days, or the certificate could not be read" fi
According to Let's Encrypt, its certificates are valid for 90 days and it recommends renewing them every 60 days, so a 30-day warning usually means automatic renewal has failed.
5. Check the certificate chain and trust
Lab example against our test server on 127.0.0.1 port 8443 (use your host and port 443):
$ echo | openssl s_client -connect 127.0.0.1:8443 -servername example.com -showcerts 2>/dev/null | grep -E '^ *[0-9] s:|^ +[iv]:' 0 s:CN=example.com i:O=Lab Test CA, CN=Lab Test Root v:NotBefore: Oct 12 10:04:04 2026 GMT; NotAfter: Jan 10 10:04:04 2027 GMT 1 s:O=Lab Test CA, CN=Lab Test Root i:O=Lab Test CA, CN=Lab Test Root v:NotBefore: Oct 12 10:04:03 2026 GMT; NotAfter: Oct 12 10:04:03 2027 GMT
Line 0 is the site's certificate (s: subject, i: issuer, v: validity); the following lines are the other certificates the server sends (normally the intermediate CA certificates), so you can also spot an expired intermediate. Add -brief for a short summary with the verification result:
Verification: OK: the chain is trusted (our lab CA was passed with-CAfile ca.pem; public certificates are checked against the system CA store).verify error:num=10:certificate has expired: renew it.verify error:num=62:hostname mismatch(with-verify_hostname example.org): the certificate does not cover that name.verify error:num=19:self-signed certificate in certificate chain: the chain ends in a CA that is not trusted, as with our lab CA.
For fixes, see SSL Certificate Not Trusted: Causes and How to Fix Them and SSL Handshake Failed: Causes and How to Fix It. To check a file against a CA bundle without a server, use openssl verify -CAfile chain.pem cert.pem (it answers cert.pem: OK).
6. Test TLS versions and mail servers
echo | openssl s_client -connect example.com:443 -tls1_2 -brief echo | openssl s_client -connect example.com:443 -tls1_3 -brief
A working version prints Protocol version: TLSv1.2 (or 1.3) and the cipher. Our test server limited to TLS 1.2 refused -tls1_3 with tlsv1 alert protocol version ... SSL alert number 70.
For mail servers that switch to TLS after connecting, add -starttls with the protocol (according to the OpenSSL manual: smtp, imap, pop3, ftp and others):
echo | openssl s_client -connect mail.example.com:587 -starttls smtp 2>/dev/null | openssl x509 -noout -subject -dates echo | openssl s_client -connect mail.example.com:143 -starttls imap 2>/dev/null | openssl x509 -noout -subject -dates
Ports 465, 993 and 995 use TLS from the start, so leave -starttls out there. Which port does what: HTTPS and SSL Port Numbers: 443, 465, 587, 993, 995 and cPanel Ports. For a test certificate of your own, see How to Create a Self-Signed SSL Certificate with OpenSSL; on Windows, first install OpenSSL on Windows.
Need a certificate for a live site? Ucartz offers DV, OV and wildcard SSL certificates with free installation help.
Official documentation: openssl-x509 manual page and openssl-s_client manual page.
