How can I use OpenSSL to check the expiration date of a client connection?

Checking the expiration date of a client connection using OpenSSL typically involves examining the server's certificate presented during the TLS handshake. OpenSSL doesn't directly "check a client connection," but you can inspect the certificate involved in that connection. Here's how you can do it:

1. Using s_client for Command-Line Inspection:

The `s_client` command is a powerful tool in OpenSSL for establishing a connection to a server and inspecting the presented certificate. You can use the following command:

openssl s_client -connect example.com:443 -showcerts

- Replace example.com:443 with the actual hostname and port of the server you're connecting to. The `-showcerts` option displays the certificate chain sent by the server.

2. Extracting the Expiration Date:

After running the above command, look for the certificate details. The expiration date is typically labeled as "notAfter". For example:

...
Certificate:
  Data:
   ...
   Validity:
      Not Before: Oct 16 00:00:00 2023 GMT
      Not After : Oct 16 23:59:59 2024 GMT
   ...

In this example, the certificate expires on "Oct 16 23:59:59 2024 GMT".

3. Using grep or Other Tools for Filtering:

You can pipe the output of the `s_client` command to grep to easily find the "notAfter" field:

openssl s_client -connect example.com:443 -showcerts 2>/dev/null | grep "Not After"

This will filter out other output and only show the line containing the expiration date. The `2>/dev/null` redirects error messages to nowhere, for cleaner output.

4. Using OpenSSL commands to Get Date directly:

You can also use command to get the notAfter date directly:

openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate

This command will return directly the end date in the format: notAfter=date

5. Scripting with OpenSSL:

For automation, you might want to use a script that executes the OpenSSL command and parses the output. Languages like Python or Bash can be used to create scripts that automate this process. For example in Bash:

#!/bin/bash
EXP_DATE=$(openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate)
echo "$EXP_DATE"


Important Considerations:

- Hostname Verification: When using the `s_client` command, ensure the hostname you're providing is correct. A misconfigured certificate might cause issues.

- Port Number: Use the correct port (usually 443 for HTTPS, or 25 for SMTP with TLS). If the server is using a non-standard port, specify it.

- Error Handling: It's good practice to include error handling in scripts, such as verifying if the connection was successful before parsing certificate details.

In summary, while OpenSSL doesn’t directly “check client connection” for expiration, the `s_client` tool along with certificate parsing (`x509` command) provides a robust method to inspect the server's certificate and retrieve the expiration date. This method is invaluable for troubleshooting and ensuring the validity of SSL/TLS connections.

Learn more about this