How to Check a Korean Digital Certificate's Expiry — Open signCert.der

Korean joint certificates must be renewed every year, and most people find out the expiry date only when a login fails with 'certificate expired'. You don't need the bank's certificate manager — opening one file shows the date.

Where the certificate file is

• •Windows: C:\Users\(your name)\AppData\LocalLow\NPKI\(issuer)\USER\(cn=name…)\. If AppData is hidden, paste %USERPROFILE%\AppData\LocalLow\NPKI into the Explorer address bar.
• •A certificate copied to a USB stick or external drive: the NPKI folder on that drive.
• •macOS: the same structure under ~/Library/Preferences/NPKI/.
• •The folder holds signCert.der (the certificate) and signPri.key (the private key). Only signCert.der is needed to check.

Open it in the browser and read the expiry

1. 1Open the FileKeeps certificate viewer and pick signCert.der with 'Choose PEM files' (DER opens too). Dropping the whole NPKI folder works as well.
2. 2The card shows the subject (your name and type), the issuer (yessign, SignKorea, and so on), and the validity period with a Valid or Expired badge.
3. 3If expiry is close (usually within a month), renew at the issuer or your bank's certificate center. Renewal is only possible through the issuer.

What else is shown

Serial number, public key type (e.g. RSA 2048), signature algorithm, and SHA-256 fingerprint are displayed too — handy when a bank asks for the certificate serial number. Whether the certificate is trusted (chain) or revoked isn't checked; the issuer and bank systems verify that at login.

The file goes nowhere

The certificate is read inside the browser only and never sent to a server; nothing remains when the tab closes. Even so, on a shared PC it's safer not to open a USB certificate at all.