How to check SSL certificate expiry on Azure

Azure App Service can use a free, auto-renewing Managed Certificate, or a certificate you import — often from Key Vault. The two behave very differently around renewal, so knowing which one a site uses matters.

The universal way: openssl

This works regardless of where your certificate is served from. It opens a TLS connection and prints the validity dates of the certificate the server presents.

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates -issuer -subject

List certificates bound to an App Service

Shows every certificate bound to apps in a resource group, including its expiration date and thumbprint:

az webapp config ssl list --resource-group MyResourceGroup \
  --query "[].{Name:name, Thumbprint:thumbprint, Expires:expirationDate}"

Check a Key Vault-stored certificate

If certificates are managed through Key Vault (common for imported or App Service Certificates), read the expiry directly from the vault:

az keyvault certificate show --vault-name MyVault --name example-com \
  --query "attributes.expires"

Azure SSL FAQ

Does an Azure App Service Managed Certificate renew automatically?

Yes — App Service Managed Certificates are free and auto-renew roughly 45 days before expiry, with no action needed, as long as the app stays on a supported (non-Free/Shared) tier and the domain’s ownership verification still passes. If a custom domain’s DNS records change, renewal can fail silently, which is the main way these still expire.

Do imported or Key Vault SSL certificates auto-renew on Azure?

No. A certificate you imported yourself — including most App Service Certificates purchased through Azure and stored in Key Vault — does not renew itself the way a Managed Certificate does. You (or an automation you set up) need to reissue and re-bind it before the `expirationDate` shown by `az webapp config ssl list` or `az keyvault certificate show` passes.

Don’t want to run this by hand every month?

SSLNudge checks Azure endpoints daily and alerts you before expiry.

Monitor it free

Tip: paste a hostname into the free SSL checker to see its expiry right now.