How to check SSL certificate expiry on Postfix

Postfix serves the certificate referenced by smtpd_tls_cert_file in main.cf. Unlike a web server, SMTP negotiates TLS via STARTTLS after an initial plaintext connection, so a plain openssl s_client -connect won’t see the certificate — you need the -starttls smtp flag.

Check the live endpoint with STARTTLS

Connect on the submission port (587) or 25, and tell openssl to negotiate STARTTLS before reading the certificate:

echo | openssl s_client -connect mail.example.com:587 -starttls smtp \
  -servername mail.example.com 2>/dev/null | openssl x509 -noout -dates -issuer

Read the certificate file on disk

Find the configured cert path and read its dates directly — useful when the certificate hasn’t been reloaded into the running process yet:

postconf smtpd_tls_cert_file
openssl x509 -enddate -noout -in /etc/postfix/certs/mail.example.com.crt

Reload, don’t restart, after renewing

A renewed certificate on disk does nothing until Postfix re-reads it. reload picks up the new files without dropping in-flight mail connections the way a full restart would:

sudo postfix reload

Postfix SSL FAQ

Why doesn’t openssl s_client show my Postfix certificate?

Because SMTP doesn’t start TLS immediately the way HTTPS does — it begins in plaintext and only switches to TLS after a STARTTLS command. Add `-starttls smtp` to `openssl s_client` (and connect on 587 or 25, not 443) so openssl performs that negotiation before it tries to read the certificate.

Don’t want to run this by hand every month?

SSLNudge checks Postfix endpoints daily and alerts you before expiry.

Monitor it free

Tip: paste a hostname into the free SSL checker to see its expiry right now.