# SSL Certificate Checker - Bulk Expiry, Chain & TLS (`admirala/ssl-certificate-expiry-checker`) Actor

Bulk SSL certificate checker: expiry date, days left, issuer, SANs, chain validation, hostname match and TLS version for any list of domains. Expiry alerts. $0.00045 per host.

- **URL**: https://apify.com/admirala/ssl-certificate-expiry-checker.md
- **Developed by:** [Ja doei](https://apify.com/admirala) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.30 / 1,000 per host with a certificate reads

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SSL Certificate Checker - Bulk Expiry, Chain & TLS

> ✅ **Tested daily** with its default input (Apify's automated QA plus our own smoke test before every release).

**SSL certificate checker** for many domains at once: paste a list of domains or URLs and get a clear report on every SSL/TLS certificate: who issued it, which names it covers, **when it expires** and whether browsers will trust it. **$0.00045 per host**. Built for agencies, sysadmins and anyone who looks after more than a handful of sites.

### What it checks

- **Expiry**: `validFrom`, `validTo`, `daysLeft`, `expired`, `notYetValid`
- **Identity**: subject, common name, all **SANs** (Subject Alternative Names)
- **Issuer**: issuing CA name and organization (Let's Encrypt, DigiCert, Sectigo ...)
- **Trust**: `chainValid` (verified against the standard CA bundle), `hostnameMatch`, `selfSigned`, verification error text
- **Connection**: negotiated **TLS version** and cipher
- **Key**: type (RSA/EC), size, signature hash, serial number
- **Alert flag**: `alert: true` with reasons when the certificate expires within your threshold, is expired, has a broken chain or does not match the hostname

### Input

| Field | Default | Description |
|---|---|---|
| `targets` | – | Hostnames or URLs (`example.com`, `https://shop.example.org:8443/page`) |
| `alertDays` | 30 | Flag certificates expiring within this many days |
| `alertOnly` | false | Only output hosts that need attention |
| `timeoutSecs` | 15 | Per-host connection timeout |

### Output (one item per host)

```json
{
  "host": "example.com", "port": 443, "tlsVersion": "TLSv1.3",
  "issuerCN": "Cloudflare TLS Issuing ECC CA 3", "subjectCN": "example.com", "sanCount": 2,
  "validFrom": "2026-09-26T22:49:11+00:00", "validTo": "2026-12-25T22:56:35+00:00",
  "daysLeft": 64, "expired": false, "chainValid": true, "hostnameMatch": true,
  "alert": false, "alertReasons": []
}
```

The key-value store record `OUTPUT` holds a summary (`checked`, `alerts`, `errors`) that is easy to feed into a webhook, Slack or email integration.

### Scheduling

Add the Actor to an Apify Schedule (for example daily) with `alertOnly: true` and connect a notification integration: you only hear about certificates that need renewing.

### Pricing (pay per event)

- **$0.00045 per host** whose certificate was read. Hosts that cannot be reached are reported but not charged.

### Notes

Only the hosts you supply are contacted, with a single TLS handshake each. No pages are downloaded and no personal data is collected.

### Use with AI agents (MCP)

This Actor can be used as a tool by AI agents (Claude, Cursor, VS Code, other MCP clients) through the official [Apify MCP server](https://docs.apify.com/platform/integrations/mcp):

- Add only this Actor as a tool: `https://mcp.apify.com?tools=admirala/ssl-certificate-expiry-checker` (sign in with OAuth or an Apify API token).
- Or connect `https://mcp.apify.com` and let the agent find it with `search-actors` (e.g. "ssl certificate checker"), read the input schema with `fetch-actor-details` and run it with `call-actor`.

Example input an agent can pass:

```json
{
  "targets": [
    "example.com",
    "https://www.wikipedia.org"
  ],
  "alertDays": 30
}
```

Cost per call: $0.00045 per host whose certificate was read; unreachable hosts are free. Results come back as dataset items (`get-dataset-items`).

### FAQ

**How do I check when an SSL certificate expires?**
Add the domain to `targets`. Each result has `validTo` and `daysLeft`, plus `alert: true` when it expires within `alertDays`.

**Can I monitor SSL expiry for many domains automatically?**
Yes: schedule the Actor daily with `alertOnly: true` and connect an email, Slack or webhook integration.

**Does it check the certificate chain?**
Yes, `chainValid` is verified against the standard CA bundle, plus `hostnameMatch` and `selfSigned`.

### Related actors

- [Website Uptime Monitor - Status, Response Time & SSL](https://apify.com/admirala/website-uptime-ssl-monitor)
- Domain Expiry Checker - Bulk WHOIS/RDAP Expiration Dates (coming soon to Apify Store)
- [WHOIS Lookup Bulk - Domain RDAP, DNS Records & SSL](https://apify.com/admirala/domain-whois-rdap-dns-lookup)
- SPF, DKIM & DMARC Checker - Bulk Email Deliverability Audit (coming soon to Apify Store)
- Security Headers Checker - Bulk HSTS, CSP Audit (A+ to F) (coming soon to Apify Store)
- [Tech Stack Detector - BuiltWith & Wappalyzer Alternative](https://apify.com/admirala/website-tech-stack-detector)
- Broken Link Checker - Find 404s & Redirects (Crawl or List) (coming soon to Apify Store)

# Actor input Schema

## `targets` (type: `array`):

Hostnames or URLs to check, e.g. \["example.com", "https://shop.example.org:8443/page"]. A custom port is allowed (host:8443); default 443. $0.00045 per host.

## `alertDays` (type: `integer`):

Set `alert: true` for certificates that expire within this many days, e.g. 30.

## `alertOnly` (type: `boolean`):

true = output only hosts that need attention (expiring, expired, invalid chain, hostname mismatch) or could not be reached.

## `timeoutSecs` (type: `integer`):

Connection and TLS handshake timeout per host in seconds (2-60).

## Actor input object example

```json
{
  "targets": [
    "example.com",
    "https://www.wikipedia.org"
  ],
  "alertDays": 30,
  "alertOnly": false,
  "timeoutSecs": 15
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "targets": [
        "example.com",
        "https://www.wikipedia.org"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("admirala/ssl-certificate-expiry-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "targets": [
        "example.com",
        "https://www.wikipedia.org",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("admirala/ssl-certificate-expiry-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "targets": [
    "example.com",
    "https://www.wikipedia.org"
  ]
}' |
apify call admirala/ssl-certificate-expiry-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,admirala/ssl-certificate-expiry-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/99uonRRBneNdcVQDR/builds/0F3ha545cKflfvdxs/openapi.json