SSL Certificate Checker API: Expiry, Issuer, SAN, Chain & DNS (bulk)

$2 per 1,000 domains checked. No API key, no login, no monthly rental. Unreachable domains, invalid inputs and filtered-out domains are free.

Paste a list of domains (hundreds or thousands), get back for each one:

• SSL/TLS certificate: issuer, expiry date, days until expiry, valid/invalid with the exact validation error (expired, self-signed, hostname mismatch, untrusted root…), subject, Subject Alternative Names (SAN), serial number, SHA-256 fingerprint, key type and size, signature algorithm, TLS version and cipher.
• Full certificate chain: leaf, intermediates and root, each with issuer and expiry.
• DNS records: A, AAAA, MX, NS, TXT, CAA, plus parsed SPF and DMARC (record + policy).
• A one-line plain-text summary per domain, ready for Slack alerts, emails or LLMs.

Built for agencies, MSPs and IT teams who monitor a portfolio of domains on a schedule: run it every morning with "Only certificates expiring within N days" or "Only new or changed certificates" and you only get (and only pay for) the domains that need attention.

How much does it cost?

Pay per event: $0.002 per domain checked (domain-checked event), charged only when a certificate was actually retrieved and delivered.

Domains	Price
100	$0.20
1,000	$2.00
10,000	$20.00

Free (never charged): domains that don't resolve, refuse HTTPS or time out; invalid inputs; duplicates; domains skipped by the expiry filter or by "only changes". The Actor stops cleanly when your spending limit is reached.

Input

{
  "domains": ["apify.com", "github.com", "https://www.example.org/page", "expired.badssl.com", "mail.example.com:8443"],
  "expiringWithinDays": 30,
  "warningDays": 30,
  "checkDns": true,
  "includeChain": true,
  "onlyChanges": false,
  "includeErrors": true,
  "maxConcurrency": 20,
  "timeoutSecs": 10
}

Field	Description
domains	Domains, URLs, host:port, IPs or internationalized names (café.fr). Duplicates removed.
expiringWithinDays	Alert mode: only output domains expiring within N days (or already expired). Empty = all.
warningDays	Below this many days, status is expiring instead of ok (default 30).
checkDns	A, AAAA, MX, NS, TXT, CAA, SPF, DMARC lookups (default on).
includeChain	Full certificate chain (default on).
onlyChanges	Only output certificates that changed since the previous run (renewals, new issuer).
includeErrors	Also write free error rows for unreachable domains (default on).

Output

One JSON object per domain in the dataset (export to JSON, CSV, Excel, HTML):

{
  "input": "expired.badssl.com",
  "domain": "expired.badssl.com",
  "port": 443,
  "status": "expired",
  "checkedAt": "2026-10-20T08:00:00Z",
  "ipAddress": "104.154.89.105",
  "certificateValid": false,
  "validationError": "certificate has expired",
  "hostnameMatches": true,
  "issuer": "COMODO CA Limited COMODO RSA Domain Validation Secure Server CA",
  "issuerOrganization": "COMODO CA Limited",
  "issuerCommonName": "COMODO RSA Domain Validation Secure Server CA",
  "subjectCommonName": "*.badssl.com",
  "validFrom": "2015-04-09T00:00:00Z",
  "validTo": "2015-04-12T23:59:59Z",
  "daysUntilExpiry": -4209,
  "isExpired": true,
  "isSelfSigned": false,
  "subjectAltNames": ["*.badssl.com", "badssl.com"],
  "subjectAltNamesCount": 2,
  "serialNumber": "4AE795493A49B0D5B2B2CC3E1F4E5E4B",
  "signatureAlgorithm": "sha256WithRSAEncryption",
  "publicKeyAlgorithm": "RSA",
  "publicKeySize": 2048,
  "sha256Fingerprint": "BA105CE02BAC76888ECEE47CD17D1AE5...",
  "tlsVersion": "TLSv1.2",
  "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
  "chainLength": 3,
  "certificateChain": [
    {"position": 0, "subjectCommonName": "*.badssl.com", "issuerCommonName": "COMODO RSA Domain Validation Secure Server CA", "validTo": "2015-04-12T23:59:59Z", "daysUntilExpiry": -4209, "isSelfSigned": false, "sha256Fingerprint": "BA10..."},
    {"position": 1, "subjectCommonName": "COMODO RSA Domain Validation Secure Server CA", "issuerCommonName": "COMODO RSA Certification Authority", "validTo": "2029-02-11T23:59:59Z", "daysUntilExpiry": 1209, "isSelfSigned": false, "sha256Fingerprint": "02AB..."}
  ],
  "dnsA": ["104.154.89.105"],
  "dnsAAAA": [],
  "dnsMX": [],
  "dnsNS": [],
  "dnsTXT": [],
  "dnsCAA": [],
  "spfRecord": null,
  "hasSpf": false,
  "dmarcRecord": null,
  "dmarcPolicy": null,
  "hasDmarc": false,
  "dnsError": null,
  "summary": "expired.badssl.com: certificate EXPIRED; issued by COMODO CA Limited ...; expires 2015-04-12 (-4209 days left); validation error: certificate has expired; 2 SANs, TLSv1.2; SPF no, DMARC no.",
  "error": null
}

status is one of ok, expiring, expired, invalid (untrusted, self-signed, hostname mismatch), error (unreachable, free). An unreachable domain looks like {"domain": "no-such-domain-xyz.com", "status": "error", "error": "Domain does not resolve (DNS): ..."} and is not charged.

Use cases

1. Agency: weekly expiry alert for 300 client websites

A web agency account manager monitors every client site. Scheduled every Monday with the alert filter, the run only returns sites expiring within 21 days, sent to Slack via Make.

Input:

{"domains": ["client-bakery.fr", "shop.client-garage.com", "client-dentist.de", "..."], "expiringWithinDays": 21, "checkDns": false}

Output (only the 2 domains needing action, so 300 checked, 2 charged = $0.004 per week):

[{"domain": "client-garage.com", "status": "expiring", "daysUntilExpiry": 9, "issuer": "Let's Encrypt R11", "validTo": "2026-10-29T10:12:00Z"},
 {"domain": "client-dentist.de", "status": "expired", "daysUntilExpiry": -3, "validationError": "certificate has expired"}]

Next: a Make scenario posts each summary to #ops and opens a ticket.

2. MSP / IT team: detect unexpected certificate changes on 1,200 hosts

A security engineer runs the Actor daily with onlyChanges on all public hosts (VPN, OWA, APIs on custom ports). Any new fingerprint (renewal by an unknown CA, replaced certificate) shows up with previousFingerprint.

Input:

{"domains": ["vpn.corp-example.com:443", "mail.corp-example.com", "api.corp-example.com:8443"], "onlyChanges": true, "includeChain": true}

Output:

[{"domain": "api.corp-example.com", "port": 8443, "certificateChanged": true, "previousFingerprint": "3F9A...", "sha256Fingerprint": "C01D...", "issuer": "DigiCert Inc DigiCert Global G2 TLS RSA SHA256 2020 CA1"}]

Next: rows go to Google Sheets as an audit trail; first run costs 1,200 × $0.002 = $2.40, then only changes are billed (typically a few cents a day).

3. Email deliverability / lead qualification: SPF & DMARC audit of 5,000 prospect domains

A deliverability consultant (or a sales team selling email security) checks which prospects have no DMARC or a p=none policy.

Input:

{"domains": ["prospect-one.com", "prospect-two.io", "..."], "checkDns": true, "includeChain": false}

Output:

[{"domain": "prospect-two.io", "hasSpf": true, "spfRecord": "v=spf1 include:_spf.google.com ~all", "hasDmarc": false, "dmarcPolicy": null, "dnsMX": [{"priority": 1, "exchange": "smtp.google.com"}], "daysUntilExpiry": 61}]

Next: filter hasDmarc = false in the CSV export and use it as an outreach list. 5,000 domains = $10.

Use via API

Python:

from apify_client import ApifyClient

client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("<username>/ssl-certificate-checker").call(run_input={
    "domains": ["apify.com", "github.com"], "expiringWithinDays": 30,
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["domain"], item["status"], item["daysUntilExpiry"])

JavaScript:

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<APIFY_TOKEN>' });
const run = await client.actor('<username>/ssl-certificate-checker').call({
    domains: ['apify.com', 'github.com'], expiringWithinDays: 30,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items.map((i) => `${i.domain}: ${i.status} (${i.daysUntilExpiry} d)`));

Synchronous call returning the items directly (handy for scripts and webhooks): POST https://api.apify.com/v2/acts/<username>~ssl-certificate-checker/run-sync-get-dataset-items?token=<APIFY_TOKEN>

Automation (Make, n8n, Zapier, Google Sheets)

Example n8n workflow: Schedule Trigger (daily 7:00) → Apify node "Run Actor and get dataset items" with input {"domains": [...], "expiringWithinDays": 14} → IF status != "ok" → Slack / Email node sending {{$json.summary}}. The same works with the Apify apps for Make and Zapier, or with Apify Schedules + the Google Sheets integration to keep a live certificate inventory sheet.

Use with AI agents (MCP)

The Actor is available through the Apify MCP server, so Claude, Cursor, ChatGPT and other AI agents can call it as a tool ("check when the certificates of these 20 domains expire and whether they have DMARC"). Each result carries a short plain-text summary field the agent can quote directly, and the input is a simple list of domains.

FAQ

Does it need an API key or account on the target sites? No. It performs a standard TLS handshake, like a browser, and public DNS queries (1.1.1.1 / 8.8.8.8). No web page is downloaded.

Do I pay for domains that are down? No. Errors, invalid inputs, duplicates and domains skipped by filters are free.

Can I check custom ports (8443, 993…)? Yes, write host:port. The port must speak TLS directly (STARTTLS is not supported).

Expired or self-signed certificates? They are still read and fully reported, with certificateValid: false and the exact validationError.

How do scheduled runs work? Create a Schedule in Apify Console with expiringWithinDays or onlyChanges; only actionable domains are output and charged.

Internationalized domains? Yes, café.fr is converted to punycode (xn--caf-dma.fr).

Limits

• DNS records are read on the exact host given: www.example.com usually has no MX/DMARC; give the root domain for email checks.
• Domain registration (WHOIS) expiry is not included, only certificate expiry.
• STARTTLS (SMTP 25/587, IMAP 143) is not supported; implicit TLS ports (443, 465, 993, 8443…) are.
• Certificate validity is judged against the Mozilla/OpenSSL trust store of the Actor's container; OCSP/CRL revocation is not checked.
• Hosts behind firewalls allowing only specific countries may time out (reported as free error).
• Up to 10,000 domains per run; split larger lists into several runs.