How to check SSL certificate expiry on Traefik

Traefik typically obtains and renews certificates automatically through a configured ACME certificate resolver, storing them in a single JSON file rather than individual cert files on disk.

The universal way: openssl

This works regardless of where your certificate is served from. It opens a TLS connection and prints the validity dates of the certificate the server presents.

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates -issuer -subject

Read expiry straight out of acme.json

Certificates issued through an ACME resolver live base64-encoded inside acme.json, keyed by the resolver name you configured (commonly myresolver). Decode the one you want and read its dates:

jq -r '.myresolver.Certificates[] | select(.domain.main=="example.com") | .certificate' acme.json \
  | base64 -d | openssl x509 -noout -dates

A note on permissions

acme.json holds private keys and Traefik refuses to start if it’s group- or world-readable. If you’re inspecting it directly, keep permissions at 600 — don’t loosen them just to read the file.

chmod 600 acme.json

Don’t want to run this by hand every month?

SSLNudge checks Traefik endpoints daily and alerts you before expiry.

Monitor it free

Related errors

Tip: paste a hostname into the free SSL checker to see its expiry right now.