# SSL Certificate & Domain Expiry Checker – Bulk Monitor (`chris_elder/ssl-domain-expiry-checker`) Actor

Check SSL/TLS certificates and domain registration expiry for thousands of domains: issuer, validity, days to expiry, hostname match, trust chain, SANs, TLS version, plus registrar expiry via RDAP. OK/WARNING/CRITICAL alerts. $1.50 per 1,000 domains; unreachable hosts are free.

- **URL**: https://apify.com/chris_elder/ssl-domain-expiry-checker.md
- **Developed by:** [Chris Elder](https://apify.com/chris_elder) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SSL Certificate & Domain Expiry Checker – Bulk Monitor

Never let a certificate or a domain expire again. Check the **SSL/TLS certificate and the domain registration** of thousands of hosts in one run and get a clear **OK / WARNING / CRITICAL** status for each.

### What it checks

| Group | Fields |
|---|---|
| SSL certificate | issuer, subject, `validFrom`, `validTo`, **`sslDaysToExpiry`**, trusted chain (`sslValid` + error), **hostname match**, Subject Alternative Names, TLS protocol, cipher, serial, SHA-256 fingerprint |
| Domain registration | registrable domain, registrar, **`domainExpiresAt`**, **`domainDaysToExpiry`** via the official RDAP registries (modern WHOIS) |
| Result | `status` (OK / WARNING / CRITICAL) and plain-English `alerts` |

### Use cases

- Scheduled monitoring: run daily with Apify Schedules, then filter `status != "OK"` and send alerts to Slack or email via integrations.
- Agencies and MSPs: audit every client domain at once.
- Domain portfolio and security teams: catch expired, untrusted or mismatched certificates.

### Input

```json
{
  "domains": ["apify.com", "github.com", "expired.badssl.com"],
  "checkDomainExpiry": true,
  "warnDays": 30
}
```

URLs are cleaned automatically (`https://www.example.com/page` → `www.example.com`). Subdomains are checked for SSL; domain expiry uses the registrable domain (e.g. `bbc.co.uk`).

### Output example

```json
{
  "domain": "expired.badssl.com",
  "status": "CRITICAL",
  "alerts": ["SSL certificate EXPIRED", "SSL not trusted: CERT_HAS_EXPIRED"],
  "issuer": "COMODO CA Limited",
  "validTo": "2015-04-12T23:59:59.000Z",
  "sslDaysToExpiry": -4203,
  "hostnameMatches": true,
  "registrar": "MarkMonitor Inc.",
  "domainDaysToExpiry": 175
}
```

📊 **Want these results in Google Sheets?** Send them straight to a Sheet with [Google Sheets Sync](https://apify.com/chris_elder/google-sheets-sync) – run it after this Actor, or add it on this Actor's **Integrations** tab so every run exports automatically.

### Pricing (pay per event)

| Event | Price |
|---|---|
| Actor start | $0.0005 per run |
| Domain checked | **$0.0015** ($1.50 per 1,000 domains); Silver $0.0012, Gold+ $0.001 |

SSL and domain-expiry checks are both included. **Hosts with no answer at all (unreachable and no registry data) are free.** Worked example: 200 client domains checked daily for 30 days = 6,000 checks = $9.

### Need the data done for you?

If you'd rather not set up runs yourself, the UK company behind these tools (GPT Shop Ltd) offers a fixed-price done-for-you scrape. Tell us the website and the fields you need, and you get a clean CSV or Google Sheet within 48 hours of the confirmed brief, up to 5,000 rows, for £149 or $179. If we can't get the data, you're refunded in full. [See the done-for-you scraper service](https://tools.gptshopltd.com/done-for-you-scraper/?utm_source=apify\&utm_medium=readme\&utm_campaign=ssl-domain-expiry-checker)

### Responsible use

One TLS handshake per host and one RDAP request per domain, using public data only. Registrant contact data is never collected.

### Related

[Bulk WHOIS Domain Lookup](https://apify.com/chris_elder/bulk-whois-domain-lookup) for full RDAP, DNS, SPF and DMARC data.

# Actor input Schema

## `domains` (type: `array`):

Hostnames to check, one per line. URLs are cleaned (https://www.example.com/page → www.example.com).

## `checkDomainExpiry` (type: `boolean`):

Look up the registrar and expiry date from the official RDAP registry. Included in the price.

## `warnDays` (type: `integer`):

Warn when expiring within (days).

## `port` (type: `integer`):

TLS port.

## `maxConcurrency` (type: `integer`):

Parallel checks.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "github.com",
    "expired.badssl.com"
  ],
  "checkDomainExpiry": true,
  "warnDays": 30,
  "port": 443,
  "maxConcurrency": 5
}
```

# Actor output Schema

## `overview` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "github.com",
        "expired.badssl.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("chris_elder/ssl-domain-expiry-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "github.com",
        "expired.badssl.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("chris_elder/ssl-domain-expiry-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "github.com",
    "expired.badssl.com"
  ]
}' |
apify call chris_elder/ssl-domain-expiry-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,chris_elder/ssl-domain-expiry-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/TbaiMJga99XGFLmN7/builds/oZh0Cidz4y7cnXzNC/openapi.json