To check SSL certificate expiration date in Rust, parse the certificate with x509-parser and read validity().not_after — from a PEM file, or from the leaf a rustls client receives after its handshake. This recipe does both, trusting a private test root, and shows the error rustls returns for an expired server certificate.

Tested with rustls 0.23.46 (Rust 1.99.1, ring provider), x509-parser 0.18.1 (notAfter of files and of the server's leaf), and OpenSSL 3.5.7 (openssl s_server as the local TLS servers).

Cargo.toml — x509-parser, and rustls with the ring provider

1[dependencies]
2x509-parser = "=0.18.1"
3rustls = { version = "=0.23.46", default-features = false, features = ["ring", "std", "tls12"] }
4

src/main.rs — notAfter from PEM files and from a TLS server

1use std::error::Error;
2use std::net::TcpStream;
3use std::sync::Arc;
4 
5use rustls::pki_types::{CertificateDer, ServerName, pem::PemObject};
6use rustls::{ClientConfig, ClientConnection, RootCertStore};
7use x509_parser::prelude::*;
8 
9/// notAfter of the first certificate in a PEM file.
10fn file_not_after(path: &str) -> Result<ASN1Time, Box<dyn Error>> {
11    let der = CertificateDer::from_pem_file(path)?;
12    let (_, cert) = X509Certificate::from_der(&der)?;
13    Ok(cert.validity().not_after)
14}
15 
16/// notAfter of the leaf a server presents, once rustls has verified the chain and the name.
17fn server_not_after(host: &str, port: u16, roots: RootCertStore) -> Result<ASN1Time, Box<dyn Error>> {
18    let config = ClientConfig::builder().with_root_certificates(roots).with_no_client_auth();
19    let mut tls = ClientConnection::new(Arc::new(config), ServerName::try_from(host.to_owned())?)?;
20    let mut tcp = TcpStream::connect((host, port))?;
21    while tls.is_handshaking() {
22        tls.complete_io(&mut tcp)?; // returns the verification error, if any
23    }
24    let leaf = tls.peer_certificates().and_then(|chain| chain.first()).ok_or("no certificate")?;
25    let (_, cert) = X509Certificate::from_der(leaf)?;
26    Ok(cert.validity().not_after)
27}
28 
29fn main() -> Result<(), Box<dyn Error>> {
30    for path in ["leaf.pem", "expired.pem"] {
31        let not_after = file_not_after(path)?;
32        let days = (not_after.timestamp() - ASN1Time::now().timestamp()).div_euclid(86_400);
33        println!("{path}: notAfter {not_after}, {days} days left");
34    }
35 
36    let mut roots = RootCertStore::empty(); // only our test root; webpki-roots has the public ones
37    roots.add(CertificateDer::from_pem_file("root.pem")?)?;
38    println!("api.example.com: notAfter {}", server_not_after("api.example.com", 8443, roots.clone())?);
39    if let Err(error) = server_not_after("expired.example.com", 9443, roots) {
40        println!("expired.example.com: {error}");
41    }
42    Ok(())
43}
44

How it works

CertificateDer::from_pem_file (from rustls::pki_types) reads the first certificate of a PEM file; X509Certificate::from_der parses it, and validity().not_after is an ASN1Time with a timestamp().
RootCertStore::empty() plus add(root) trusts only the test root; for public servers fill it from webpki-roots or the platform verifier.
ClientConnection::new with a ServerName sets SNI and the name to verify; complete_io drives the handshake over a plain TcpStream and returns any verification error.
peer_certificates() returns the chain the server sent, leaf first; the run prints Dec 31 23:59:59 2035 +00:00 for it.

Gotchas

rustls refuses the expired server outright: invalid peer certificate: certificate expired: verification time … (UNIX), but certificate is not valid after 1743465599 (… seconds ago). The Unix time in the message is the notAfter, if you need it.
ASN1Time prints as Dec 31 23:59:59 2035 +00:00; for RFC 3339 output use to_datetime() with the time crate's formatting.
Integer division truncates toward zero; div_euclid(86_400) floors, so an expired certificate reports -568 days rather than -567.

How to check SSL certificate expiration date in Rust

How it works

Gotchas

Related recipes