How to check SSL certificate expiration date in Go

1package main
2 
3import (
4	"crypto/tls"
5	"crypto/x509"
6	"encoding/pem"
7	"errors"
8	"net"
9	"os"
10	"time"
11)
12 
13// fileNotAfter reads the first certificate of a PEM file.
14func fileNotAfter(path string) (time.Time, error) {
15	data, err := os.ReadFile(path)
16	if err != nil {
17		return time.Time{}, err
18	}
19	block, _ := pem.Decode(data)
20	if block == nil || block.Type != "CERTIFICATE" {
21		return time.Time{}, errors.New(path + ": no CERTIFICATE block")
22	}
23	cert, err := x509.ParseCertificate(block.Bytes)
24	if err != nil {
25		return time.Time{}, err
26	}
27	return cert.NotAfter, nil // UTC
28}
29 
30// serverNotAfter connects with full verification and returns the leaf's expiry
31// and the earliest expiry along the verified chain.
32func serverNotAfter(addr, serverName string, roots *x509.CertPool) (leaf, chain time.Time, err error) {
33	dialer := &net.Dialer{Timeout: 10 * time.Second}
34	conn, err := tls.DialWithDialer(dialer, "tcp", addr, &tls.Config{RootCAs: roots, ServerName: serverName})
35	if err != nil {
36		return leaf, chain, err
37	}
38	defer conn.Close()
39	state := conn.ConnectionState()
40	leaf, chain = state.PeerCertificates[0].NotAfter, state.PeerCertificates[0].NotAfter
41	for _, cert := range state.VerifiedChains[0] {
42		if cert.NotAfter.Before(chain) {
43			chain = cert.NotAfter
44		}
45	}
46	return leaf, chain, nil
47}
48 

1package main
2 
3import (
4	"crypto/tls"
5	"crypto/x509"
6	"fmt"
7	"log"
8	"os"
9	"time"
10)
11 
12func main() {
13	for _, path := range []string{"leaf.pem", "expired.pem"} {
14		notAfter, err := fileNotAfter(path)
15		if err != nil {
16			log.Fatal(err)
17		}
18		days := int(time.Until(notAfter).Hours() / 24)
19		fmt.Printf("%s: notAfter %s, %d days left\n", path, notAfter.Format(time.RFC3339), days)
20	}
21 
22	roots := x509.NewCertPool() // only our test root; nil would mean the system roots
23	rootPEM, err := os.ReadFile("root.pem")
24	if err != nil || !roots.AppendCertsFromPEM(rootPEM) {
25		log.Fatal("cannot load root.pem")
26	}
27	leaf, chain, err := serverNotAfter("api.example.com:8443", "api.example.com", roots)
28	if err != nil {
29		log.Fatal(err)
30	}
31	fmt.Println("api.example.com: leaf", leaf.Format(time.RFC3339), "chain", chain.Format(time.RFC3339))
32 
33	// An expired certificate fails verification, so read it without verifying — only to look at it
34	_, _, err = serverNotAfter("expired.example.com:9443", "expired.example.com", roots)
35	fmt.Println("verified:", err)
36	conn, err := tls.Dial("tcp", "expired.example.com:9443", &tls.Config{InsecureSkipVerify: true})
37	if err != nil {
38		log.Fatal(err)
39	}
40	defer conn.Close()
41	fmt.Println("unverified: notAfter", conn.ConnectionState().PeerCertificates[0].NotAfter.Format(time.RFC3339))
42}
43