---
title: openssl — certificate and TLS verification
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A tool for checking certificate contents, expiration dates, and TLS connections.
tags: program, Web server operations, openssl
---

**💬 "openssl command"**

openssl directly checks **certificate information and TLS connections**. It is essential for diagnosing expiration and chain issues.

You can inspect both local certificate files and remote server TLS handshakes.

- **Concept**: Handles certificates/keys and inspects TLS connections.
- **x509**: Prints certificate details and expiration dates.
- **s_client**: Directly checks remote TLS connections.
- **Items to check**: subject, SAN, validity period, chain, and protocol.
## Commonly used options

| Option | Description |
| --- | --- |
| x509 -noout -dates | Check only the certificate validity period |
| x509 -noout -subject -issuer | Check subject/issuer |
| s_client -connect | Check a remote TLS connection |
| -servername <domain> | Specify SNI to check a virtual host certificate |

## 3 essential command combinations

- `openssl x509 -in /etc/nginx/ssl/site.crt -noout -dates` — Check local certificate expiration date
- `echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates` — Check remote certificate expiration date
- `openssl x509 -in site.crt -noout -subject -issuer -ext subjectAltName` — Check subject, issuer, and SAN
**💬 "Tell me one way to reduce trial and error with this"**

Here are common situations on production servers, organized in order.

### Step 1 · Check local certificate

Check the expiration date of the certificate installed on the server.

```
openssl x509 -in /etc/nginx/ssl/site.crt -noout -dates
```

### Step 2 · Remote check

Check the certificate that is actually being served.

```
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -dates
```

### Step 3 · Expiration management

If expiration is imminent, proceed with renewal.

```
openssl x509 -in /etc/nginx/ssl/site.crt -noout -checkend 2592000
```

## This is how it is used in practice

### 1. Responding to certificate expiration warnings

**Situation** — Monitoring alerted that the certificate expires in 30 days.

```
openssl x509 -in /etc/nginx/ssl/site.crt -noout -checkend 2592000
```

**Result** — If it expires within 30 days, a warning message is printed.

**Point** — Also check whether automatic renewal (certbot timer) is working before expiration.

### 2. Checking certificates by domain

**Situation** — Multiple domains use one IP, but only one specific domain has a certificate error.

```
echo | openssl s_client -connect 203.0.113.24:443 -servername shop.example.com 2>/dev/null | openssl x509 -noout -subject
```

**Result** — Check whether the certificate for the domain requested via SNI is returned.

**Point** — If SNI is not specified, the default certificate may be returned and cause confusion.

## Things to watch out for

- s_client is for diagnostics. It may differ from actual browser validation (chain and SAN).
- Manage permissions so private key files are not exposed.
- Expiration checks are based on UTC and may differ from local time.
## Actual execution output

This is the result of checking the subject, validity period, and whether the local certificate is nearing expiration.

![openssl command output: certificate information and expiration](https://games.aidebatehub.com/assets/openssl-demo.png)

Production server

---
Source (HTML): https://games.aidebatehub.com/programs/linux/webserver/openssl.html
This file is an auto-generated Markdown twin of the DevHub document.