SSL/TLS Certificate Check & Expiry Monitor

Know before a certificate expires — and spot broken ones. Give it hosts or HTTPS URLs; for each it does a passive TLS handshake (exactly what a browser does) and reports the certificate: days until expiry, issuer, subject, SANs, TLS version — with a clear signal. Schedule it and point webhookUrl at Slack/email (via Make/Zapier) to get an alert before a cert lapses. Keyless, agent-callable.

🔒 Passive & read-only. It only completes a standard TLS handshake and reads the presented certificate — no payloads, no probing, no scanning. An expiring cert is a reminder, not a vulnerability.

⚡ Why it's useful

An expired certificate takes a site or API down and throws scary browser warnings. This gives you the exact days remaining across all your hosts in one call — and flags expired, self-signed, or hostname-mismatched certs — so you renew on your schedule, not after an outage.

📋 What each report contains

Field	Meaning
signal	valid / expiring-soon / expiring-very-soon / expired / invalid-certificate / unreachable
daysUntilExpiry	Days remaining until the certificate expires
notAfter / notBefore	Validity window
issuer	Certificate authority (e.g. Sectigo, Amazon, Let's Encrypt)
subjectCommonName / subjectAltNames	The certificate's subject and all covered domains
tlsVersion / cipher	Negotiated TLS version and cipher
reason	Why a cert is invalid/unreachable (e.g. "certificate has expired", "self-signed")

📥 Input

{ "hosts": ["github.com", "https://your-site.com", "mail.example.com:993"], "warnDays": 30, "criticalDays": 7 }

Set onlyProblems: true for scheduled alerting (returns just the hosts needing attention). Add :port for non-443 services. One report per host.

📤 Example output (real run, trimmed)

{ "host": "github.com", "signal": "expiring-soon", "daysUntilExpiry": 44,
  "notAfter": "Nov 29 23:59:59 2026 GMT", "issuer": "Sectigo Limited",
  "subjectAltNames": ["github.com", "www.github.com"], "tlsVersion": "TLSv1.3" }

In the same run apify.com returned valid (92 days), expired.badssl.com → expired, and self-signed.badssl.com → invalid-certificate ("self-signed certificate").

💰 Pricing (pay-per-event)

• Host checked — $0.01 per host.

💡 Use cases

• Ops / SRE / IT: a standing expiry alarm across every domain and service you run.
• Agencies / MSPs: monitor all client certificates from one place.
• Security / compliance: flag expired, self-signed or mismatched certs across your estate.
• Agents: callable as an MCP tool — give it hosts, get back certificate health.

🔑 Keyless & agent-callable

No API keys, no accounts, no external services, no paid child Actors — just a standard TLS handshake.

🚀 Ready-made tasks (one click)

• SSL Certificate Checker - Validity, Issuer & Expiry
• SSL Expiry Monitor - Alert Before Certificates Expire
• TLS Certificate Problem Check - Expired, Self-Signed, Mismatch

🤖 For AI agents (MCP)

https://mcp.apify.com/?tools=actors,docs,centorprat/ssl-certificate-expiry-check

Loads as centorprat--ssl-certificate-expiry-check. Claude Code:

claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/ssl-certificate-expiry-check