TLS certificates — issuer, expiry, self-signed, and what to do before it lapses

netscrew reads the certificate on every HTTPS port it finds and counts down to expiry. Here's what the fields mean and when to worry.

When n check finds an HTTPS port it connects, reads the certificate and prints the subject (who it's for), the issuer (who vouched for it) and days to expiry.

Reading the line

• Issuer = Let's Encrypt / ZeroSSL / a public CA — a publicly trusted certificate; browsers accept it. Let's Encrypt certificates last 90 days and are meant to auto-renew; if the days-left number keeps falling below 30, the renewal job is broken.
• Issuer = the subject itself — *self-signed*. Normal for a NAS, a router, a Proxmox box, a printer. Browsers warn; you can pin it or install your own CA. Not a problem on a LAN; a problem if it's on the internet.
• Issuer = an internal CA ("Home CA", "pfSense") — fine as long as your devices trust that CA.
• Subject doesn't match the name you used — a SAN mismatch: the certificate is for nas.home and you connected to 192.168.1.5. Browsers will complain even though the certificate is otherwise good.

Expiry

• > 30 days — fine. < 14 days — check renewal now. Expired — every client will refuse or warn; automated jobs (backups, webhooks) silently fail.

Look for yourself

openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates