For example, I want to find out when the certificate for encrypted.google.com expires (i.e. Not After date), and what other domains may use it for authentication (Subject Alternative Names).

  • I don't think we need the x509 tag. In 30k+ Q's this the 1st time it's come up, I think for the level of this Q the use of ssl and certificates is plenty. Please correct me if I'm wrong.
    – slm
    Dec 11, 2013 at 2:33
  • These are all the Q's that contain x509: unix.stackexchange.com/search?q=x509
    – slm
    Dec 11, 2013 at 2:40
  • On the off chance I asked this Q on meta: meta.unix.stackexchange.com/questions/2565/…
    – slm
    Dec 11, 2013 at 2:44
  • Looking at answers below, apparently the x509 certificates had little to none to do with the problem.
    – Braiam
    Dec 12, 2013 at 15:15

2 Answers 2


You could simply write it:

openssl s_client -showcerts -connect encrypted.google.com:443 < /dev/null \
   2> /dev/null | openssl x509 -noout -enddate

Other options than -enddate can be used to retrieve other fields. -text outputs most of the information.

See also keytool from java:

keytool -printcert -sslserver encrypted.google.com:443

It will print the whole certificate chain if possible (some of the certificate possibly retrieved from the Java certificate store).

  • what about Subject Alternative Names?
    – jfs
    Dec 10, 2013 at 22:23
  • 2
    @J.F.Sebastian, openssl x509 only displays it with -text Dec 10, 2013 at 22:40
  • @J.F.Sebastian - I saw no other method in wiki either beyond -text. wiki.cacert.org/FAQ/subjectAltName. I think what Stephane's provided is your answer.
    – slm
    Dec 11, 2013 at 2:56
  • 1
    @slm, note that J.F.Sebastian answered his own question, he was just sharing his nice script to retrieve certificate information in a useful way. I was just mentioning an alternative way to call the openssl command. (generally, you don't need -in as openssl takes its input from stdin, and you can retrieve (some) individual parameters without having to parse the output of -text). Dec 11, 2013 at 9:57
  • @StephaneChazelas - I hadn't given the other answer a thorough look, since it looked like an awful lot of code, now looking at it I see what you're saying. Thanks.
    – slm
    Dec 11, 2013 at 12:49

To print server's certificate as text using openssl:

# Show server's certificate in a human-readable form.
# Usage: $ show-cert HOST [PORT]
exec <&- # close stdin to suppress `read:errno=0` from openssl
exec openssl x509 -noout -text \
     -in <(openssl s_client -connect "$1":"${2:-443}" -showcerts)

Or using Python to get output in json format:

#!/usr/bin/env python3
"""Show server's certificate as json.

  $ %(prog)s HOST [PORT]
import json
import socket
import ssl
import sys

def getcert(addr, timeout=None):
    """Retrieve server's certificate at the specified address (host, port)."""
    # it is similar to ssl.get_server_certificate() but it returns a dict
    # and it verifies ssl unconditionally, assuming create_default_context does
    with socket.create_connection(addr, timeout=timeout) as sock:
        context = ssl.create_default_context()
        with context.wrap_socket(sock, server_hostname=addr[0]) as sslsock:
            return sslsock.getpeercert()

def main(argv):
    host = argv[1]
    port = int(argv[2]) if len(argv) > 2 else 443
    print(json.dumps(getcert((host, port)), indent=2, sort_keys=True))

if __name__ == "__main__":


$ getcert encrypted.google.com | jq -r '.notAfter, .subjectAltName[][1]'
Mar 20 00:00:00 2014 GMT

The latest version: getcert.py

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.