How to check SSL certificate expiry on Docker
Docker itself doesn’t terminate TLS — the certificate belongs to whatever’s running inside the container (nginx, a Node app, a registry) or to the Docker daemon’s own client-auth TLS. Where you look depends on which of those you mean.
Check a container’s exposed HTTPS port
If the container publishes 443 (or any TLS port) to the host, this works exactly like checking any live endpoint — Docker is transparent to it:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -dates -issuerRead a certificate mounted into a container
If the cert is a bind-mounted file or volume, read it from inside the container with whatever tools the image has — or reach in from the host if the volume path is known:
docker exec my-container openssl x509 -enddate -noout -in /etc/ssl/certs/example.com.crtThe Docker daemon’s own TLS (dockerd --tlsverify)
If you’ve secured the Docker API itself with client certificates, those live wherever --tlsverify/--tlscert point — commonly /etc/docker/certs.d/ for registry certs, or ~/.docker/ for a remote daemon’s client cert. This is separate from any certificate your containerized app serves.
openssl x509 -enddate -noout -in ~/.docker/cert.pemDon’t want to run this by hand every month?
SSLNudge checks Docker endpoints daily and alerts you before expiry.
Related errors
Tip: paste a hostname into the free SSL checker to see its expiry right now.