How to check SSL certificate expiry on Caddy

Caddy is unusual among the platforms here: by default it obtains and renews certificates for you automatically via ACME (Let’s Encrypt or ZeroSSL), with no config required. Checking expiry is mostly about confirming that automation is actually working.

The universal way: openssl

This works regardless of where your certificate is served from. It opens a TLS connection and prints the validity dates of the certificate the server presents.

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates -issuer -subject

Read a certificate from Caddy’s storage

Caddy stores managed certificates under its data directory — by default ~/.local/share/caddy/certificates/ on Linux/macOS (or %AppData%\Caddy on Windows), inside a folder named for the ACME issuer. Read the file directly:

find ~/.local/share/caddy/certificates -name "example.com.crt"
openssl x509 -enddate -noout -in ~/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/example.com/example.com.crt

Confirm auto-renewal is actually running

Caddy renews certificates itself roughly a month before expiry — there’s no cron job to set up. If a live check shows an old certificate, look at the Caddy process logs for issuance/renewal errors (a failed HTTP-01/DNS-01 challenge is the usual cause) rather than assuming you need to intervene manually:

journalctl -u caddy --since "7 days ago" | grep -i cert

Caddy SSL FAQ

Does Caddy renew SSL certificates automatically?

Yes, by default. Caddy obtains certificates via ACME the first time it needs them and renews automatically around a month before expiry, with no cron job, timer, or config required. Manual intervention is only needed if the renewal challenge itself is failing — for example DNS records changed or port 80/443 became unreachable.

Where does Caddy store SSL certificates?

In its configured storage path — `~/.local/share/caddy/certificates/` by default on Linux and macOS — inside a subfolder named after the ACME issuer (e.g. `acme-v02.api.letsencrypt.org-directory`) and then the domain name. Each domain folder holds the `.crt`, `.key` and metadata files Caddy manages itself.

Don’t want to run this by hand every month?

SSLNudge checks Caddy endpoints daily and alerts you before expiry.

Monitor it free

Related errors

Tip: paste a hostname into the free SSL checker to see its expiry right now.