TopicCybersecurity →
⌚ About 2 min read
Check the validity period of the TLS certificate submitted by a site.
Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.
Étapes à suivre
-
1
Use a browser for visual inspection
Open the site security information and then the certificate.
-
2
Check dates
Find the start and end fields.
-
3
Check the name covered
Check that the certificate covers the domain name used.
-
4
Automate if necessary
For many services, use certificate supervision rather than manual control.
À retenir
- A valid certificate can still be misconfigured if the intermediate string is incorrect.
- Anticipate renewal instead of waiting for of expiration.
HTTPS/TLS: separate HTTP availability, TLS handshake and certificate identity
Technical checkpoints
- An open port 443 does not prove a valid TLS handshake, and a valid handshake does not prove an HTTP 200 response.
- The certificate must cover the hostname via SAN, be within its validity window and present a complete trust chain.
- With SNI, testing the IP alone may present a different certificate than the DNS hostname.
OpenSSL + HTTP
Test the handshake with the correct servername then read HTTP status separately.
openssl s_client -connect example.com:443 -servername example.com -showcerts
curl -I https://example.com/Topic-specific pitfalls
- Do not confuse an expired certificate with a missing intermediate chain: client errors differ.
- Schannel 36874/36888 should be correlated with protocol/cipher and the client triggering the alert.
How to validate
- Hostname, chain, dates and protocol are valid from a representative client.
- The HTTP request