certguard

Check SSL certificate expiry from the command line.

Install

pip install certguard

uv tool install certguard

brew install hamzaplojovic/tap/certguard

Usage

Check a single host:

certguard check example.com

Check multiple hosts at once:

certguard check example.com google.com github.com

Use a custom port:

certguard check example.com:8443

Read hosts from a file (one per line, comments with #):

certguard check --file hosts.txt

Output as JSON:

certguard check example.com --json

Set a custom warning threshold (default is 30 days):

certguard check example.com --warn-days 14

Output

certguard prints a table with one row per host. Columns include the host, port, status, expiry date, days remaining, and certificate issuer.

Status is color-coded:

• OK (green) means the certificate is valid and not expiring soon.
• EXPIRING (yellow) means the certificate expires within the warning threshold.
• EXPIRED (red) means the certificate has already expired.
• ERROR (red) means the connection failed (DNS, timeout, refused, etc.).

The exit code is 0 if all certificates are valid and not expiring soon, or 1 if any certificate is expired, expiring, or unreachable.

Options

Why I built this

I got tired of manually checking certificate expiry dates across a bunch of domains. I wanted a single command I could run (or throw into a cron job) that tells me which certs are about to expire so I can fix them before they cause downtime. certguard does that and nothing more.

License

MIT