SSL Certificate Expiry Checker

From the command line: openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -noout -text. From a file: openssl x509 -in /path/to/cert.pem -noout -text. From nginx: look for ssl_certificate in nginx.conf; from Apache, look for SSLCertificateFile. The PEM starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.

Best practice: renew 30 days before expiry. Let's Encrypt auto-renews at 30 days (certificate lifetime is 90 days). Commercial CAs typically renew at 30–60 days. Never let a certificate expire — browsers show hard errors with no bypass option for expired certs, destroying user trust and causing immediate revenue loss.

SANs are the list of domains/IPs the certificate is valid for. Modern browsers use SANs exclusively — the CN (Common Name) is ignored for host validation. A certificate for example.com should have SANs: ['example.com', 'www.example.com']. Wildcard SANs like *.example.com cover one subdomain level. Multi-domain (SAN) certificates cover multiple unrelated domains.

This means the certificate's issuer (CA) is not in the browser's trusted CA store. Possible causes: self-signed certificate, missing intermediate certificate in the chain (most common production issue), CA not trusted by this browser version, or the certificate was issued by a revoked CA. Fix: ensure you're serving the full chain (leaf + intermediates) in your TLS config.

Modern servers should use TLS 1.2 or 1.3. Avoid: TLS 1.0/1.1 (deprecated), RC4, DES, 3DES, MD5 signatures. Prefer: ECDSA over RSA for certificates (smaller, faster), ECDHE for key exchange (forward secrecy), AES-GCM for encryption. Use ssllabs.com/ssltest for a comprehensive server configuration grade.