How to check certificate expiry using OpenSSL

TLS certificates can parse correctly while still expiring before a renewal window, release freeze, or load balancer change. OpenSSL reads the validity fields in an X.509 certificate file and can turn an expiry check into a shell status for scripts and deployment checks.

The openssl x509 command inspects a certificate file directly. -dates prints the notBefore and notAfter timestamps, while -checkend asks whether notAfter falls inside a threshold counted in seconds from the system clock.

Use server.crt as the sample PEM certificate path and replace it with the certificate file that will be deployed. Run the check against the leaf certificate, not a private key, CSR, or chain bundle unless the first certificate in that bundle is the exact certificate being approved.

Steps to check certificate expiry using OpenSSL:

Print the certificate validity dates.
```
$ openssl x509 -in server.crt -noout -dates
notBefore=Jun 30 07:15:14 2026 GMT
notAfter=Sep 28 07:15:14 2026 GMT
```
notAfter is the expiry timestamp. notBefore is the first time the certificate is valid.
Check whether the certificate remains valid for at least 30 days.
```
$ openssl x509 -in server.crt -noout -checkend 2592000
Certificate will not expire
```
2592000 seconds equals 30 days. The command exits with status 0 when the certificate does not expire inside that window.
Confirm the success status for the 30-day window.
```
$ echo $?
0
```
Check the status immediately after openssl x509 -checkend when a script or release gate needs the result.
Check a longer 180-day policy window.
```
$ openssl x509 -in server.crt -noout -checkend 15552000
Certificate will expire
```
15552000 seconds equals 180 days. This output means the certificate's notAfter time falls inside that window.
Confirm the failed status for the longer window.
```
$ echo $?
1
```
A nonzero status means the certificate expires before the requested window ends. Renew or replace the certificate before approving that policy check.