Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to know when an SSL certificate actually expires. Does it just look at the expiry date, or does it also take into account the expiry time?

Let's say a certificate expired on 1/1/2013 at 11am. Does that certificate expire at 11:01am or is it only the following day that the certificate expires? I have been told both are true.

Hope that makes sense! Our suppliers messed up and let our certificate expire, and I'm trying to figure out how much compensation we're owed.

I found this question Details on exact expiration datetime of an SSL certificate? but it didn't quite answer what I need (and I didn't like to revive a dead question).

share|improve this question

2 Answers 2

up vote 2 down vote accepted

They have a time as well as a date. Taking one of my own certificates, obtained with openssl s_client, and putting it into openssl x509 -text -noout, I find (amongst other things) that:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 513100 (0x7d44c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=GeoTrust, Inc., CN=RapidSSL CA
        Validity
            Not Before: Aug 16 06:07:05 2012 GMT
            Not After : Oct 16 09:42:56 2016 GMT

As you can see, the certificate is very precise about when it expires. Yours should be, too.

share|improve this answer
    
Thanks! So am I right in saying that with your example at Oct 16 10:00:00 2016 GMT the browsers would then kick up a fuss saying the certificate is no longer valid? Just wanna be crystal clear! –  CYMR0 Oct 10 '12 at 20:58
    
That's client-dependent (ie, it's up to the browser), but it's certainly what you'd expect a well-behaved browser to do. If your suppliers claim certificates expire on a day, they're wrong; they expire on a second, as I've shown. But if they claim that some browsers don't care until the following day, they should be asked which browsers, and for some proof. –  MadHatter Oct 11 '12 at 6:05

The expiration time is down to the second. It really shouldn't matter though since the certificate should be renewed / migrated / etc weeks in advance in any professional organization.

share|improve this answer
    
Thanks! Yeah, I know. I even reminded said profesional organisation about it a month ago. They're saying that the expiry time doesn't matter though, and that it is only the following day, that the certificate expires and browsers complain. –  CYMR0 Oct 10 '12 at 21:00
    
@CYMR0, whether or not browsers complain based on the time may well be browser dependant. –  John Gardeniers Oct 10 '12 at 21:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.