Skip to main content

Automatic check for expiring SSL certificates

A quick solution to periodically check your certificates for expiring and get a notification via mail before they expire. I have multiple PKI’s and found it really useful to have such a automatic service.

The tool ssl-cert-check, which is part of the Debian package repository, does a quite good job finding expiring certificates but unfortunately doesn’t support analyzing directories. Luckily the author of this tool implemented this feature in the latest version available on GitHub.

First we have to clone the repo to have the latest version available on our system.

cd /opt
git clone
ln -s /opt/ssl-cert-check/ssl-cert-check /usr/local/bin/

I created a small shell script which does the actually check and send a mail if a certificate will expire in <=60 Days. Gist also available here.

#!/usr/bin/env bash

SH=$(readlink -f "${0}")
SH_PATH=$(dirname "${SH}")



ssl-cert-check -a -d "${CERT_DIR}/*.crt" -q -x ${EXP_DAYS} -E ${SENDER} -e ${SEND_TO}
exit $?

I placed the script within the ssl-cert-check folder. The script will check all certificates in the subfolder certs. Here is the folder structure:

drwxr-xr-x 2 root root 4.0K Feb 13 18:29 certs
-rwxr-xr-x 1 root root  280 Feb 13 18:42 check-certs
drwxr-xr-x 8 root root 4.0K Feb 13 18:16 .git
-rw-r--r-- 1 root root  15K Dec 17 12:56 LICENSE
-rw-r--r-- 1 root root 3.3K Dec 17 12:56
-rwxr-xr-x 1 root root  31K Feb 13 18:16 ssl-cert-check

To include certificates, we just need to create a symlink in the certs folder. I added links to my easy-rsa PKI’s to include them.

lrwxrwxrwx 1 root root 27 Feb 13 18:29 ipsec-pki -> /etc/ipsec.d/pki/db/issued/
lrwxrwxrwx 1 root root 27 Feb 13 18:27 openvpn-pki -> /etc/openvpn/pki/db/issued/
lrwxrwxrwx 1 root root 25 Feb 13 18:22 root-pki -> /var/certs/pki/db/issued/

For a periodically check, we finally need to add the script to the cron daemon. For a daily check:

ln -s /opt/ssl-cert-check/check-certs /etc/cron.daily/