If you just want to know whether the certificate has expired (or will do so within the next N seconds), the
-checkend <seconds> option to
openssl x509 will tell you:
if openssl x509 -checkend 86400 -noout -in file.pem then echo "Certificate is good for another day!" else echo "Certificate has expired or will do so within 24 hours!" echo "(or is invalid/not found)" fi
This saves having to do date/time comparisons yourself.
openssl will return an exit code of
0 (zero) if the certificate has not expired and will not do so for the next 86400 seconds, in the example above. If the certificate will have expired or has already done so - or some other error like an invalid/nonexistent file - the return code is
(Of course, it assumes the time/date is set correctly)
Here’s my bash command line to list multiple certificates in order of their expiration, most recently expiring first.
for pem in /etc/ssl/certs/*.pem; do printf '%s: %s\n' \ "$(date --date="$(openssl x509 -enddate -noout -in "$pem"|cut -d= -f 2)" --iso-8601)" \ "$pem" done | sort
2015-12-16: /etc/ssl/certs/Staat_der_Nederlanden_Root_CA.pem 2016-03-22: /etc/ssl/certs/CA_Disig.pem 2016-08-14: /etc/ssl/certs/EBG_Elektronik_Sertifika_Hizmet_S.pem