How to check SSL certificate expiry on Postfix
Postfix serves the certificate referenced by smtpd_tls_cert_file in main.cf. Unlike a web server, SMTP negotiates TLS via STARTTLS after an initial plaintext connection, so a plain openssl s_client -connect won’t see the certificate — you need the -starttls smtp flag.
Check the live endpoint with STARTTLS
Connect on the submission port (587) or 25, and tell openssl to negotiate STARTTLS before reading the certificate:
echo | openssl s_client -connect mail.example.com:587 -starttls smtp \
-servername mail.example.com 2>/dev/null | openssl x509 -noout -dates -issuerRead the certificate file on disk
Find the configured cert path and read its dates directly — useful when the certificate hasn’t been reloaded into the running process yet:
postconf smtpd_tls_cert_file
openssl x509 -enddate -noout -in /etc/postfix/certs/mail.example.com.crtReload, don’t restart, after renewing
A renewed certificate on disk does nothing until Postfix re-reads it. reload picks up the new files without dropping in-flight mail connections the way a full restart would:
sudo postfix reloadPostfix SSL FAQ
Why doesn’t openssl s_client show my Postfix certificate?
Because SMTP doesn’t start TLS immediately the way HTTPS does — it begins in plaintext and only switches to TLS after a STARTTLS command. Add `-starttls smtp` to `openssl s_client` (and connect on 587 or 25, not 443) so openssl performs that negotiation before it tries to read the certificate.
Don’t want to run this by hand every month?
SSLNudge checks Postfix endpoints daily and alerts you before expiry.
Related errors
Tip: paste a hostname into the free SSL checker to see its expiry right now.