Show TLS Certificate Dates

Browsers or monitors report a certificate problem, and you need to read the validity dates from the certificate the edge actually serves.

Command

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not inspect local certificate files when the question is what users receive from the live edge.

`notBefore` and `notAfter` dates from the served certificate, not merely from a file on disk.

Read-only, sensitive output. Nothing changes. The command performs a read-only TLS handshake and prints the served certificate dates.

Recovery / rollback: no state is changed.

Use when browsers report expiry, monitoring says TLS is invalid, or a deploy may have left the edge serving an old certificate.

Do not inspect local certificate files when the question is what users receive from the live edge.

next steps

Web Server Rescue Sensitive output

The cert was valid, but not for this hostname.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

Web Server Rescue Sensitive output

The IP was right. The SNI name selected the wrong certificate.

openssl s_client -connect example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

Linux Survival Basics Sensitive output

The certificate can be valid but issued for the wrong name.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Web Server Rescue Sensitive output

The certificate was fine. The TLS negotiation told the rest of the story.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | awk '/Protocol|Cipher|Verify return code/ {print}'

Linux Survival Basics Sensitive output

SANs decide which hostnames the certificate covers.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.