Calculate days remaining until an SSL/TLS certificate expires and renewal deadline.
TLS/SSL certificates carry a fixed validity window (notBefore/notAfter fields in the X.509 certificate), and days remaining is simply the difference between the expiry date and today. Alerting on a single 'expired/not expired' boolean is too late to act on — production monitoring typically layers a warning threshold (e.g. 30 days, enough time to procure/rotate a cert through change management) and a critical threshold (e.g. 7 days, requiring immediate action) so renewal work is scheduled well before an outage-causing expiry.
Days remaining
days_remaining = expiry_date − today
`openssl x509 -enddate -noout -in cert.pem` prints the notAfter date directly. For a live server, use `echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -enddate`.
CA/Browser Forum baseline requirements (and enforcement by Apple's Safari/root program since 2020) limit publicly-trusted certificate lifetimes to reduce the exposure window if a certificate's private key is compromised or if it was issued to a domain that later changes ownership — shorter lifetimes force more frequent, safer re-validation.
Tools like `certbot` (Let's Encrypt ACME client) or cert-manager (Kubernetes) automatically renew certificates well before expiry and reload the serving process, eliminating the human error and forgotten-renewal risk that causes the majority of real-world expiry-related outages.