Check a site’s TLS expiry and security headers from the terminal

After setting up a reverse proxy, or when a certificate is about to expire somewhere, you want a quick answer: when does the certificate run out, who issued it, and does the site send the headers it should? This script answers in a few seconds and exits non-zero if the certificate expires within two weeks, so it can also run from cron or CI.

The script

#!/usr/bin/env bash
set -euo pipefail

usage() { echo "Usage: $(basename "$0") <hostname> [warn-days]" >&2; exit 2; }

host=${1:-}
warn_days=${2:-14}
[[ -n "$host" ]] || usage
host=${host#https://}
host=${host#http://}
host=${host%%/*}

echo "== TLS certificate for $host"
cert=$(echo | openssl s_client -servername "$host" -connect "$host:443" 2>/dev/null | openssl x509 -noout -subject -issuer -enddate) \
  || { echo "Could not fetch a certificate from $host:443" >&2; exit 1; }
printf '%s\n' "$cert"

end=$(printf '%s\n' "$cert" | sed -n 's/^notAfter=//p')
if end_epoch=$(date -d "$end" +%s 2>/dev/null); then
  :
else
  end_epoch=$(date -j -f '%b %d %T %Y %Z' "$end" +%s)
fi
now=$(date +%s)
days=$(( (end_epoch - now) / 86400 ))
echo "Days until expiry: $days"

status=0
if (( days < warn_days )); then
  echo "WARNING: certificate expires in less than $warn_days days"
  status=1
fi

echo
echo "== Security headers"
headers=$(curl -sSI -L --max-time 15 "https://$host/" | tr -d '\r')
for name in strict-transport-security content-security-policy x-content-type-options \
            x-frame-options referrer-policy permissions-policy; do
  if line=$(printf '%s\n' "$headers" | grep -i -m1 "^$name:"); then
    printf 'OK       %s\n' "$line"
  else
    printf 'MISSING  %s\n' "$name"
  fi
done

echo
echo "== Headers that reveal software"
printf '%s\n' "$headers" | grep -iE '^(server|x-powered-by):' || echo "none"

exit "$status"

How to run it

chmod +x check-site.sh
./check-site.sh example.com
./check-site.sh https://www.example.com/some/page    # scheme and path are stripped
./check-site.sh example.com 30                       # warn if fewer than 30 days remain

== TLS certificate for example.com
subject=CN=example.com
issuer=C=US, O=Let's Encrypt, CN=R11
notAfter=Jan  8 09:14:22 2027 GMT
Days until expiry: 85

== Security headers
OK       strict-transport-security: max-age=31536000; includeSubDomains
MISSING  content-security-policy
OK       x-content-type-options: nosniff
MISSING  x-frame-options
OK       referrer-policy: strict-origin-when-cross-origin
MISSING  permissions-policy

== Headers that reveal software
server: nginx

How it works

• openssl s_client -servername opens a TLS connection with SNI, so the right certificate is returned on a server that hosts many names. The leading echo | closes the connection immediately once the handshake is done.
• openssl x509 -noout -subject -issuer -enddate prints the fields from the certificate it received.
• The expiry date is parsed with GNU date -d on Linux and, if that fails, with BSD date -j -f on macOS, so the same script runs on both.
• curl -sSI -L fetches only the headers, following redirects, and tr -d '\r' removes the carriage returns HTTP lines end with. The loop greps for each recommended header, case-insensitively.
• The exit code is 1 when the certificate is close to expiry, which lets a cron job or CI step fail loudly.

Variations

# Several sites from a list, one per line
while read -r site; do ./check-site.sh "$site" || echo "ATTENTION: $site"; done < sites.txt

# Just the expiry check, for cron (exits 1 if fewer than 14 days remain)
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -checkend $((14*24*3600)) || echo "example.com certificate expires soon"

# Full certificate chain details
echo | openssl s_client -servername example.com -connect example.com:443 -showcerts 2>/dev/null | head -n 40

The script checks the site the way a browser would see it, so it also catches a proxy that is up but serving the wrong certificate or missing headers after a configuration change. The openssl x509 -checkend option in the variations is the simplest building block if you only want expiry monitoring; see the openssl-x509 manual for its other options.