A certificate can be read: openssl shows who it was issued to, by whom and for how long.
HTTPS is HTTP inside a protected TLS connection. At the start of the connection the server sends the client its certificate, and only if the certificate passes the checks does the client send the HTTP request.
openssl s_client connects to a server as a client and prints what it received. </dev/null closes the connection right away, 2>/dev/null hides the service lines, and openssl x509 after the | reads the certificate from that output and prints the fields asked for.
Read the server's certificate
Look at the fields of the certificate secure.lab.test serves, and compare its validity with the current date.
| Field | What it holds |
|---|---|
subject |
who the certificate was issued to: CN is the site name |
issuer |
who issued and signed it |
notBefore |
from what moment the certificate is valid, in GMT |
notAfter |
until what moment it is valid |
The client compares the validity with its own clock. Once notAfter is in the past, the certificate has expired, and curl closes the connection with certificate has expired. If the machine's clock is off, even a fresh certificate can look expired, so the dates are checked against the output of date.
Validity is set in advance: internal CAs issue certificates for a year or less, the public Let's Encrypt for 90 days. That makes replacing certificates routine work for an administrator.