Lion Cipher Lab
Monitor TLS certificate expiry with a Python script
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Expired TLS certificates are one of the most common self-inflicted outages in the industry: the certificate that encrypts your site silently reaches its 'not after' date, every browser starts throwing a full-page security warning, customers can't reach you, and the fix is trivial but the clock already ran out. The renewal reminder the certificate authority emailed went to an inbox nobody reads. Reading one certificate by hand with openssl doesn't scale to the dozens of hostnames a real environment runs. This lab gives you the at-scale, automated version: a short Python script that checks the…
What you'll learn
- opening a TLS connection in Python with ssl.create_default_context() and socket
- sending the correct hostname with SNI (server_hostname) so virtual hosts serve the right certificate
- reading getpeercert() and parsing the notAfter field into a date
- computing days-until-expiry and alerting under a threshold
- looping over many hosts and handling connection, timeout, and certificate errors without crashing
- scheduling the check with cron (Linux/macOS) and Task Scheduler (Windows)
- knowing when a homegrown monitor is enough and when to graduate to auto-renewal or a purpose-built tool
Steps in this lab
- Why automate this at all — the point before the code
- Confirm Python 3 is installed — nothing else to install
- The manual way first — and why it doesn't scale
- Write the script — a TLS expiry checker in the standard library
- Run it and read every line of output
- Handle the real-world failures — a monitor must not crash on one bad host
- Schedule it so it runs itself
- Why this, not that — and when NOT to lean on it
- The way a pro does it — and the security angle