I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active.

How may I check if it was valid at the time?

  • The certificate includes the time at which it began being valid, and at which time it stopped being valid. The only issue here is revocation status. I don't know any method of querying if a certificate has been revoked at a certain time or not
    – user163495
    Commented Jul 21, 2021 at 14:52

1 Answer 1


The validity of a certificate can be shown by any tool that can parse / decode X.509 certificates:

openssl x509 -text -in <certficiate.cer>

You may have to add -inform DER if your certificate is in binary form instead of PEM (base 64 text with header and footer lines).

        Not Before: Mar 31 09:10:51 2020 GMT
        Not After : Mar 31 09:20:00 2021 GMT

The validity period is in between the notBefore and notAfter fields that are mandatory for any X.509v3 certificate.

If you want to check if the certificate was valid according to the CA you may want to check the revocation status as well. Usually that means that you need to provide CRL (Certificate Revocation List) files.

You could perform a full verification check with chains and whatnot by using:

openssl verify -verbose -attime <etc>

If you do not have access to the CRL's then you cannot say for sure if a certificate was valid a the time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .