Domain & SSL Expiry Monitor: Never Lose A Site To A Lapsed Renewal

Know how many days are left on every domain and every certificate you are responsible for, before a customer tells you.

An expired domain takes a site off the internet. An expired certificate puts a full page security warning in front of every visitor. Both are silent until the day they are not, and both are avoidable with one number: days remaining.

Point this at your list of domains and get that number for each one, plus the registrar holding the domain, the authority that issued the certificate, whether a transfer lock is set, and a plain language alert on anything that needs attention.

Built for agencies with client sites, IT and ops teams, and anyone holding a portfolio of domains they did not personally register.

How it works

flowchart LR
    A[Your domain list] --> B[Read the host<br/>and the registrable domain]
    B --> C[Registry lookup<br/>over RDAP]
    B --> D[TLS handshake<br/>on port 443]
    C --> E[Expiry, registrar,<br/>lock, DNSSEC, nameservers]
    D --> F[Certificate expiry, issuer,<br/>hostnames, trust check]
    E --> G{Compare against<br/>your warning windows}
    F --> G
    G --> H[(One row per domain<br/>with an alert level)]

Two independent checks run for every entry. The registry lookup uses RDAP, the structured replacement for WHOIS that registries publish themselves, so there is no scraping and no key to supply. The certificate check opens the same TLS connection a browser opens and reads what the server actually serves, which is the only way to catch a renewal that quietly stopped working.

What you get

One row per domain. A real row from a live run:

{
  "domain": "stripe.com",
  "host": "stripe.com",
  "status": "ok",
  "alerts": [],
  "daysUntilDomainExpiry": 368,
  "daysUntilCertExpiry": 66,
  "domainExpiresAt": "2027-09-11T04:00:00.000Z",
  "registrar": "SafeNames Ltd.",
  "registrarIanaId": "447",
  "transferLocked": true,
  "dnssecEnabled": false,
  "nameservers": ["ns-1087.awsdns-07.org", "ns-423.awsdns-52.com"],
  "certIssuer": "DigiCert Inc",
  "certIssuerName": "DigiCert Global G3 TLS ECC SHA384 2020 CA1",
  "certExpiresAt": "2026-11-12T23:59:59.000Z",
  "certAltNames": ["stripe.com", "www.stripe.com"],
  "certCoversWww": true,
  "tlsProtocol": "TLSv1.3",
  "certTrusted": true,
  "certTrustError": null,
  "checkedAt": "2026-09-07T16:35:46.671Z"
}

And a row that needs someone to act:

{
  "host": "expired.badssl.com",
  "status": "critical",
  "alerts": ["SSL certificate expired 4166 days ago"],
  "daysUntilCertExpiry": -4166,
  "certIssuer": "COMODO CA Limited",
  "certTrusted": false,
  "certTrustError": "CERT_HAS_EXPIRED"
}

Alert levels

Every row carries one status, so a scheduled run sorts itself.

Status	What it means	Examples
ok	Nothing expiring inside your warning windows	Certificate renews in 66 days
warning	Something expires soon, or the setup is dated	Domain expires in 12 days, server negotiated TLS 1.1
critical	Already broken for visitors	Certificate expired, certificate does not cover the hostname, domain lapsed
error	The check could not be completed	Host did not answer, domain is not registered

The two warning windows are yours to set. Thirty days on the domain matches what registrars want before a renewal. Fourteen days on the certificate catches automated renewal that has stopped working, since Let's Encrypt starts renewing at thirty days and retries for a fortnight before the certificate actually lapses.

What gets checked

flowchart TB
    subgraph Registry[Registry record, over RDAP]
        R1[Expiry date]
        R2[Registrar and IANA id]
        R3[Transfer lock]
        R4[DNSSEC]
        R5[Nameservers]
    end
    subgraph Certificate[Certificate, over TLS]
        C1[Expiry date]
        C2[Issuing authority]
        C3[Hostnames covered]
        C4[Trusted for this host]
        C5[Protocol version]
    end

The certificate check validates the full chain the way a browser does, so it catches three failures that a simple expiry date never will: a certificate that is trusted but does not cover the hostname being served, a self signed or incomplete chain, and a server still negotiating a protocol that browsers now reject.

Example input

{
  "domains": [
    "example.com",
    "https://www.clientsite.co.uk/pricing",
    "shop.anotherclient.com",
    "mail.example.com:8465"
  ],
  "domainWarningDays": 30,
  "certWarningDays": 14,
  "onlyProblems": true
}

A bare domain, a full URL and a subdomain all work. Add a port to check a certificate that is not served on 443. Turn on onlyProblems for a scheduled run so the dataset holds only what needs acting on, which makes it a working inbox rather than a report nobody opens.

Run it from the command line

curl -X POST "https://api.apify.com/v2/acts/arched_friend~domain-ssl-monitor/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["example.com", "clientsite.co.uk"],
    "domainWarningDays": 30,
    "certWarningDays": 14,
    "onlyProblems": true
  }'

Put it on a schedule

Set the Actor to run daily and point the run at whatever you already use. Every row carries status and alerts, so a filter on status != "ok" is the whole integration: send those rows to Slack, open a ticket, or drop them in a sheet the account team reads. The run summary in the key value store holds the counts and the soonest expiries if you want a digest rather than rows.

Pricing

$0.004 per domain checked. Both checks are included in that, and a domain checked once is billed once no matter how many times a lookup is retried.

	This Actor	Certificate monitoring SaaS	Doing it by hand
100 domains, daily	about $12 a month	$20 to $100 a month	Hours, and it stops happening by week three
Domain expiry included	Yes	Usually a separate product
Certificate trust and hostname checks	Yes	Varies
Data you own	Dataset, API, webhook	Their dashboard
Setup	Paste a list	Agent or DNS records

Notes and limits

Not every registry publishes the same detail, and the Actor says which rather than leaving an empty column.

• Registries with no public RDAP service, including .de, .io, .so and .ch, come back as recordStatus: "unsupported-tld". The certificate check still runs normally, so those domains are monitored, just without a registration date.
• Some registries publish a record with no expiry date at all, .nl and .au among them. Those rows carry recordStatus: "no-expiry-published".
• A domain the registry has never heard of comes back as not-registered, which is worth knowing if it was meant to be yours.
• Registries rate limit per address. The default of five domains at a time is comfortable for lists in the hundreds. Lower it if lookups start failing on a very large list.

Related products

• Tech Stack Checker for what a site is built on, from the same list of domains.
• Website Lead Extractor for the emails, phones and social profiles on those sites.
• Google Reviews Monitor for what customers are saying about the businesses behind them.