SSL Certificate Expiry Monitoring: Free Scripts vs Automated Tools

A certificate expiring unnoticed is one of the most avoidable outages there is - and one of the most common, because renewal is often automated, and automated things fail silently right up until the moment they don't. If what you need is "tell me N days before this specific certificate expires," a small script solves that completely, and it's worth having even if you use other tooling too.

The script that actually solves expiry countdowns

A few lines of bash, on a daily cron job, does the whole job:

• echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate gets the certificate's expiry date.
• Compare it against today plus your warning window (e.g. 14 or 30 days).
• Mail yourself if it's inside that window.

For a handful of certificates you already know about, this is genuinely a complete answer. We'd rather say that plainly than pretend you need a platform for it.

What SurfaceDiff does with the same information

SurfaceDiff checks every certificate on every scheduled scan against a 7-day window, the same idea as the script above - inside that window it's a TLS_EXPIRING_SOON finding; already expired is its own TLS_EXPIREDfinding, at higher severity. No separate cron job, no separate thing to maintain - it comes from the same scan that's already checking DNS, subdomains, open ports and web services.

The part a standalone expiry script doesn't do is the other half: TLS certificates are also part of the full snapshot each scan diffs, so an actual change- a certificate renewed, replaced with a different one, or removed entirely - shows up as its own finding too, alongside everything else that changed in that scan. That catches things a pure expiry-checker never watches for at all, like an unfamiliar certificate suddenly appearing on a subdomain that shouldn't have TLS configured yet.

If a certificate or two is genuinely all you need to watch, the script above is a complete answer on its own. If you want that same expiry warning covering everything discovered across your whole attack surface - plus the change-detection half a script can't do - that's what continuous attack surface monitoring adds on top.

Run a free scan to see what it finds on a domain you manage, certificates included.