Why check SSL expiry from the terminal?
Every SSL certificate expires. When it does, your site shows a browser warning, your API calls fail, and your customers leave. The big monitoring services will sell you a $10/month subscription to tell you when it's about to happen. But the underlying check is trivial: open a connection, read the certificate, parse the expiry date.
You don't need a SaaS subscription for that. You need a script that runs on your machine, takes a URL, and prints the days remaining.
The one-liner
DeskUptime's CLI is free. Run it with npx — no install, no npm publish needed:
$ npx github:mahope/deskuptime check https://example.com ✅ https://example.com Status: 200 OK Response: 85ms 🔒 SSL: 63 days ✅ — Content: 559 bytes
That's it. The 🔒 line shows exactly how many days until expiry. Green if >30 days, yellow if 14–30 days, red if <14 days.
Compare with openssl
The traditional way takes a bit more work:
$ openssl s_client -connect example.com:443 \ -servername example.com < /dev/null 2>/dev/null \ | openssl x509 -noout -enddate notAfter=Oct 27 12:00:00 2026 GMT
Then you parse the date, calculate days until expiry, and write a wrapper script. DeskUptime does all that for you and adds HTTP status and content change detection in the same output.
Multiple domains, one command
Check a whole list at once:
$ npx github:mahope/deskuptime check \ https://example.com \ https://shop.example.com \ https://admin.internal.example.com ✅ https://example.com SSL: 63 days ✅ ✅ https://shop.example.com SSL: 180 days ✅ 🚨 https://admin.internal.example.com SSL: 3 days 🔥
Each URL gets its own SSL check. The exit code is 0 if all are healthy, 3 if any certificate expires within 14 days — ideal for CI/CD gate checks.
Watch mode — automatic alerts
For ongoing monitoring, watch mode checks every N seconds and alerts on changes:
$ deskuptime watch https://mystore.com --interval 3600 [10:15 AM] ✓ SSL: 63 days ✅ [11:15 AM] ✓ SSL: 63 days ✅ ...next day at 10:15 AM... [10:15 AM] 🚨 SSL: 13 days 🔥
The free watch mode monitors up to 3 URLs. Pro ($19 one-time) removes the limit and adds email alerts.
Use in CI/CD
Block a deployment if SSL is about to expire:
# GitHub Action step
- uses: mahope/deskuptime@v1
with:
urls: |
https://production.example.com
# After this step, ${{ steps.check.outputs.down-count }}
# tells you how many URLs failed
Exit code 3 (SSL warning) works as a gate — fail the pipeline, alert the team, renew the certificate before it's too late.
FAQ
How do I check SSL certificate expiry from the command line?
Run npx github:mahope/deskuptime check https://yoursite.com. You get the SSL issuer, days until expiry, and HTTP status. No install, no account needed.
What is the openssl command to check SSL certificate expiry?
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -enddate. This prints the expiry date. You then need to parse it and compare to today.
Can I check SSL expiry for multiple domains at once?
Yes. DeskUptime accepts multiple URLs: npx github:mahope/deskuptime check https://site1.com https://site2.com https://site3.com. It checks each one and reports SSL status for all.
Is there a free SSL certificate expiry checker?
Yes. DeskUptime's CLI is free with no limits on SSL checks. The Pro version ($19 one-time) adds unlimited monitoring URLs, the desktop app, and email alerts for expiring certificates.
Related: Desktop Website Monitor — Kill Your $144/year SaaS Uptime Bill