How to check my own certificate for validity (expiration)?

[Vodnik]

I'm working on primitive web-server application that uses Synapse (ssl_openssl3) for networking. It uses certificate to establish TLS connection. Web-server waits for webhooks, then save data to DB. Currently works under Windows, have plans to port to Linux, too. I want to check the certificate that I use (my server side) for expiration and start to log a warning few days before. I can not find appropriate functions in Synapse for that. Please advise the way how this can be done.

[Thaddy]

Not synapse, but:

Code: Pascal  [Select][+][-]

1. uses
2.   fphttpclient, opensslsockets; // opensslsockets is crucial for HTTPS
3.  
4. procedure TYourClass.HandleVerifyCertificate(Sender: TObject;
5.   AHandler: TSSLSocketHandler; var aAllow: Boolean);
6. begin
7.   // Here you can access AHandler.CertificateData
8.   // to check the validity period and decide if aAllow should be True or False.
9.   WriteLn('Checking certificate...');
10.   // Add your logic to read the expiration date
11.   aAllow := True; // Set to False to reject the certificate
12. end;
13.  
14. // ... in your method where you use TFPHTTPClient
15. var
16.   Client: TFPHTTPClient;
17. begin
18.   Client := TFPHTTPClient.Create(nil);
19.   try
20.     Client.OnVerifyCertificate := @HandleVerifyCertificate;
21.     // The verification event will fire when you make the request
22.     Client.Get('https://your-website.com');
23.   finally
24.     Client.Free;
25.   end;
26. end;

Not mine, found it. Synapse would be similar. Source is DeepSeek and not nonsense.

[Vodnik]

Seems this will check partner's certificate, not my own.

[Чебурашка]

Perhaps checking server certificate could be done using server OS tools, not by application. Btw checking a server certificate is not even related to application being ran. This is why examples seem to focus on intercepting client calls and suggesting to implement on-call client cert validation.

[PierceNg]

Use the OpenSSL CLI

Code: Text  [Select][+][-]

1. % openssl x509 -text -noout -in www.samadhiweb.com.crt
2. Certificate:
3.     Data:
4.         Version: 3 (0x2)
5.         Serial Number:
6.             05:2b:61:f6:33:83:14:8d:e8:51:90:69:b5:7e:2a:4a:52:85
7.         Signature Algorithm: ecdsa-with-SHA384
8.         Issuer: C = US, O = Let's Encrypt, CN = YE2
9.         Validity
10.             Not Before: Jul 11 05:18:57 2026 GMT
11.             Not After : Oct  9 05:18:56 2026 GMT
12.         Subject: CN = www.samadhiweb.com
13.         Subject Public Key Info:
14.         ...
15.  

[korba812]

You can decode the certificate using fpasn.pas and read the corresponding values.

https://gitlab.com/freepascal.org/fpc/source/-/blob/main/packages/fcl-hash/src/fpasn.pp?ref_type=heads
https://gitlab.com/freepascal.org/fpc/source/-/blob/main/packages/fcl-hash/examples/dumppem.lpr?ref_type=heads

[Thaddy]

Seems this will check partner's certificate, not my own.

Both parties need to have the public certificates in there certificate chain, the server needs to hold the private certificate.

[LeP]

@Vodnik
It's simple, but I use Indy (with TaurusTLS)... I try to explain.

You must "create" a x509 certificate from runtime IOHandler of your server.
I use SNI, so I have a collection of certificate .. but it is the same if you have only one.

Use something like this:

(NOTE: the variable OpenSSL1 must be istantiated from you server, of course)

Code: Pascal  [Select][+][-]

1.   var certi: TTaurusTlsx509;                     //Class to manage the certificate ... Synapse should exposed one similar
2.       OpenSSL1: TTaurusTLSServerIOHandler;      //Class SSL IoHandler ... like before
3.   begin
4.     //Certificates[0] is the first cerificate loaded in the SSL IOHandler (I have ten of those).
5.     //You should use the "default" with Synapse I think.
6.     certi := TTaurusTlsx509.Create(OpenSSL1.Certificates[0].x509);
7.     writeln(certi.notAfter.ToString);
8.   end;
9.  

output:

22/09/2026 21:49:51