How to check SSL certificate expiry on Azure
Azure App Service can use a free, auto-renewing Managed Certificate, or a certificate you import — often from Key Vault. The two behave very differently around renewal, so knowing which one a site uses matters.
The universal way: openssl
This works regardless of where your certificate is served from. It opens a TLS connection and prints the validity dates of the certificate the server presents.
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -dates -issuer -subjectList certificates bound to an App Service
Shows every certificate bound to apps in a resource group, including its expiration date and thumbprint:
az webapp config ssl list --resource-group MyResourceGroup \
--query "[].{Name:name, Thumbprint:thumbprint, Expires:expirationDate}"Check a Key Vault-stored certificate
If certificates are managed through Key Vault (common for imported or App Service Certificates), read the expiry directly from the vault:
az keyvault certificate show --vault-name MyVault --name example-com \
--query "attributes.expires"Azure SSL FAQ
Does an Azure App Service Managed Certificate renew automatically?
Yes — App Service Managed Certificates are free and auto-renew roughly 45 days before expiry, with no action needed, as long as the app stays on a supported (non-Free/Shared) tier and the domain’s ownership verification still passes. If a custom domain’s DNS records change, renewal can fail silently, which is the main way these still expire.
Do imported or Key Vault SSL certificates auto-renew on Azure?
No. A certificate you imported yourself — including most App Service Certificates purchased through Azure and stored in Key Vault — does not renew itself the way a Managed Certificate does. You (or an automation you set up) need to reissue and re-bind it before the `expirationDate` shown by `az webapp config ssl list` or `az keyvault certificate show` passes.
Don’t want to run this by hand every month?
SSLNudge checks Azure endpoints daily and alerts you before expiry.
Related errors
Tip: paste a hostname into the free SSL checker to see its expiry right now.