Script SSL Expiry Checks

On 6 minutes, 52 seconds read By Edward
A picture of SSL expiry checks to signify using cURL to check fo rexpiry date

Live stream set for 2025-04-23 at 14:00:00 Eastern

Ask questions in the live chat about any programming or lifestyle topic.

This livestream will be on Odysee or you can watch below.

Certificate Expiry Monitoring

SSL certificates are crucial for website security, ensuring data is encrypted and protected from hackers. Expired certificates create a security vulnerability, impacting trust and potentially damaging the reputation of the website.

Regular monitoring of SSL expiry dates is essential for maintaining website security. Manual checks are time-consuming and prone to error, especially when managing multiple websites. Automated checks ensure proactive security measures, preventing downtime and potential issues.

Let’s Encrypt announced the end of its sending expiration notification emails service. Let’s Encrypt is a free, automated, and open Certificate Authority run by the nonprofit Internet Security Research Group (ISRG).

The focus of this tutorial will be on creating a custom script to check for the expiry date of a an SSL certificate using either command line cURL or PHP and curl.

  1. Create a list of domains including subdomains to be tracked.
  2. Choose command line scripting language such as Bash or PHP.
  3. Create a script to check the listed domains.
  4. Manually run the script.
  5. Set up a cronjob to automate the script at least every 2 weeks.

Requirements For cURL

Glossary:

SSL

Secure Sockets Layer is an encryption security protocol.

TLS

Transport Layer Security is a cryptographic protocol for secure communication over a network.

HTTPS

Hypertext Transfer Protocol Secure is an extension of the Hypertext Transfer Protocol (HTTP).

SSL Certificate

Digital certificate that authenticates a website’s identity and enables an encrypted connection between the web server and the browser.

CA

Certificate Authority or Certification Authority is an entity that stores, signs, and issues digital certificates.

Tools

Programming Tools
Name Description Example
Text editor For creating and editing source code Apache Netbeans IDE
SSH Secure Shell Client OpenSSH
Shell Access Access to the command line. Terminal
Name Description Example

Obtain Certificate Dates Using cURL

# Get SSL Expiry Date Via cuRL #
curl -vI https://www.example.com 2>&1 | grep "expire date"
# Get SSL Start And Expiry Dates #
curl -w %{certs} https://www.example.com --silent -o /dev/null | grep -Ei "^(start|expire) date:"

Obtain Certificate Dates Using PHP cURL

/*
 * check-cert.php
 * 
 * Copyright 2025 Edward Ojambo <http://ojambo.com>
 * 
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 * MA 02110-1301, USA.
 * 
 * 
 */
$url = "https://www.example.com";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CERTINFO, true);
$output = curl_exec($ch);
$info = curl_getinfo($ch);
curl_close($ch);
echo $info['certinfo'][0]['Start date'];
echo $info['certinfo'][0]['Expire date'];

Optional Cron Job Running Twice A Month

# Runs At Midnight On The 1st And 15th Every Month #
0 0 1,15 * *	/path/to/your/script.sh

Explanation:

  1. Get the certificate using the curl command.
  2. Parse the certificate for the dates.
  3. The pseudo code is to simply compare the current day to the expiry date and then send an email notification to yourself if desired.

The Let’s Encrypt acme.sh command was not used because it might change due to the notifications policy change. Using other methods allows the monitoring to take place on the sever or remotely including on a workstation locally.

cURL Obtaining Domain SSL Expiry Dates
cURL Command Line Tool Obtaining Domain SSL Expiry Dates

PHP cURL Obtaining Domain SSL Expiry Dates
PHP cURL Extension Obtaining Domain SSL Expiry Dates


Usage

You can run cURL on the command-line, or integrated into PHP as an extension. For this tutorial, cURL was used to obtain the expiry date of a domain SSL Certificate. The command line tool and library curl can be downloaded from curl is also libcurl. PHP scripting language can be downloaded from PHP. Then the downloaded file is extracted directly on the server or locally before individual files are uploaded if applicable.

Open Source

The command-line tool cURL is licensed under the curl Licensed which is inspired by MIT/X. The permissive license has conditions requiring preservation of copyright and license notices. It allows commercial use, modification, distribution, and allows making derivatives proprietary, consult the license for more specific details.

The PHP scripting language is licensed under the PHP License. The permissive license has conditions requiring preservation of copyright and license notices. Redistribution is permitted in source or binary form with or without modifications, consult the license for more specific details.

Conclusion:

Let’s Encrypt is a free and easy way to obtain and manage SSL certificates. Manage notifications of your SSL Certificates manually or automated by cron jobs using cURL on the command line or via PHP.

If you enjoy this article, consider supporting me by purchasing one of my WordPress Ojambo.com Plugins or programming OjamboShop.com Online Courses or publications at Edward Ojambo Programming Books or become a donor here Ojambo.com Donate

References:

Leave a Reply

Your email address will not be published. Required fields are marked *