Linux Server / Networking, SSH & Web Services
Inspect the certificate file a Linux service is configured to load
A renewed certificate on disk may not be the one a daemon serves, or the file may have the wrong name or validity window.
Environment and inputs: Linux server baseline · Ubuntu 24.04 LTS / RHEL 9-style systems. Use the specified distribution, init system and installed tool; service names, privileges and supported options can differ.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
openssl x509 -in /etc/ssl/certs/app.pem -noout -subject -issuer -datesRead the result
With OpenSSL, this reads public certificate metadata from the selected file. It does not display a private key or prove the daemon loaded that certificate.
Resolve and verify
Compare the file with the service binding and the remote presented certificate, then validate the chain and controlled reload. Confirm the expected hostname works afterward.
Before changing production
Do not copy private keys into diagnostic output or remove older certificate files before checking dependent services.