Skip to main content

Automatic check for expiring SSL certificates

A quick solution to periodically check your certificates for expiring and get a notification via mail before they expire. I have multiple PKI’s and found it really useful to have such a automatic service.

The tool ssl-cert-check, which is part of the Debian package repository, does a quite good job finding expiring certificates but unfortunately doesn’t support analyzing directories. Luckily the author of this tool implemented this feature in the latest version available on GitHub.

First we have to clone the repo to have the latest version available on our system.

I created a small shell script which does the actually check and send a mail if a certificate will expire in <=60 Days. Gist also available here.

I placed the script within the ssl-cert-check folder. The script will check all certificates in the subfolder certs. Here is the folder structure:

To include certificates, we just need to create a symlink in the certs folder. I added links to my easy-rsa PKI’s to include them.

For a periodically check, we finally need to add the script to the cron daemon. For a daily check:

Leave a Reply

Your email address will not be published. Required fields are marked *