How to check SSL certificate expiry on DigitalOcean
On DigitalOcean, TLS is usually terminated at a Load Balancer or by App Platform rather than on the droplet itself. Both are checkable from the live endpoint; Load Balancer certs are also listed directly via doctl.
The universal way: openssl
This works regardless of where your certificate is served from. It opens a TLS connection and prints the validity dates of the certificate the server presents.
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -dates -issuer -subjectList Load Balancer certificates with doctl
DigitalOcean-managed (Let’s Encrypt) Load Balancer certificates auto-renew; certificates you uploaded yourself do not. Either way, doctl shows the expiration and type:
doctl compute certificate list --format Name,DNSNames,Type,State,NotAfterApp Platform
Certificates for App Platform’s default and custom domains are fully managed — there’s no certificate resource to inspect via doctl. Confirm expiry the same way any visitor’s browser would: check the live endpoint.
DigitalOcean SSL FAQ
Does DigitalOcean auto-renew my SSL certificate?
It depends on the certificate type. A Load Balancer certificate issued through DigitalOcean’s own Let’s Encrypt integration auto-renews. A certificate you uploaded yourself (a "custom" certificate) does not — you’re responsible for reissuing and re-uploading it before it expires. App Platform’s managed domains are always auto-renewed.
Don’t want to run this by hand every month?
SSLNudge checks DigitalOcean endpoints daily and alerts you before expiry.
Related errors
Tip: paste a hostname into the free SSL checker to see its expiry right now.