SSL Certificate Checker: Bulk Expiry & Domain Expiry Monitor

For AI agents: Use when asked to check SSL certificates, find certs expiring soon, debug a certificate error, or check when domains expire. Call with domains (domains or URLs; required), optional warnDays (default 30), checkDomainExpiry (RDAP, default on), onlyProblems: true to return only hosts that need attention, port. Returns one row per host: host, status, daysUntilExpiry, validTo, issuer, domainDaysUntilExpiry, registrar, tlsVersion, problems (expired, expiring, untrusted, hostname mismatch). Cost: $0.001 per host checked ($1 per 1,000); unreachable hosts free.

For people: Ask your agent "check the SSL certificates on these 20 domains and tell me which expire in the next 30 days" and it checks them all here and replies with just the ones to renew, plus any domain registrations about to lapse. 1,000 hosts cost $1.

Check SSL certificates for hundreds or thousands of domains in one run. Paste a list of domains or URLs and this SSL certificate checker connects to each one, reads the TLS certificate and tells you how many days are left until it expires, who issued it, which hostnames it covers, whether the chain is trusted, whether the hostname matches, and which TLS version and cipher the server negotiates. It also looks up the domain registration expiry date and registrar (via RDAP, the official successor to WHOIS), so one scheduled run catches both an expiring certificate and an expiring domain.

No agents to install, no monitoring subscription: it runs in the cloud, exports to CSV, Excel, JSON or Google Sheets, and can run on a daily or weekly schedule with an email, Slack or webhook alert when anything turns red.

What does this SSL checker do?

• 🔐 Certificate details for every host: subject, issuer and issuer organization, valid-from / valid-to dates, days until expiry, serial number, SHA-256 fingerprint, key type and size (RSA/EC), all DNS SANs and wildcard detection.
• 🚦 Status per host: ok, expiring (within your warning window, default 30 days), expired, invalid (untrusted chain, self-signed, or hostname not covered) or error (unreachable / no TLS).
• 🧾 Plain-English problems list, e.g. "Certificate expires in 12 days", "Hostname not covered by certificate", "Not trusted: UNABLE_TO_VERIFY_LEAF_SIGNATURE", "Outdated protocol TLSv1.1".
• 🌐 Domain expiry check (RDAP): registration expiry date, days left, registration date and registrar of the registrable domain.
• 🔗 Chain and protocol: certificate chain, negotiated TLS version, cipher, ALPN (HTTP/2 support) and handshake time.
• 🧹 Bulk-friendly: accepts bare domains, URLs and custom ports (host:8443), removes duplicates, checks 10-50 hosts in parallel.
• 📊 A SUMMARY record with counts by status, ideal for dashboards and alerts.

Use cases

• SSL expiry monitoring for all your company's domains and subdomains, without a paid uptime tool.
• Agencies and MSPs: one weekly job over every client site, exported to Google Sheets.
• Domain portfolio management: spot domains about to lapse and certificates about to expire in the same report.
• Security and compliance audits: find self-signed, untrusted, mismatched or TLS 1.0/1.1 endpoints.
• Competitor and vendor research: see which CA and certificate type a list of sites uses.

How to use it

1. Paste domains or URLs into Domains or URLs, one per line.
2. Optionally change Warn when expiring within (days) and turn Only output problems on for alert-style runs.
3. Click Start, then open the Overview table or export it. For monitoring, add a Schedule (e.g. daily) and an integration (email, Slack, webhook) in Apify Console.

Input example

{
  "domains": ["example.com", "shop.example.com", "https://api.example.org:8443"],
  "warnDays": 30,
  "checkDomainExpiry": true,
  "onlyProblems": false
}

Output example

{
  "host": "github.com",
  "port": 443,
  "url": "https://github.com",
  "status": "ok",
  "problems": [],
  "daysUntilExpiry": 39,
  "validFrom": "2026-03-06T00:00:00.000Z",
  "validTo": "2026-11-29T23:59:59.000Z",
  "issuer": "Sectigo Public Server Authentication CA DV E36",
  "issuerOrganization": "Sectigo Limited",
  "subject": "github.com",
  "trusted": true,
  "hostnameMatch": true,
  "sans": ["github.com", "www.github.com"],
  "wildcard": false,
  "chainLength": 2,
  "keyType": "EC",
  "tlsVersion": "TLSv1.3",
  "cipher": "TLS_AES_128_GCM_SHA256",
  "alpn": "h2",
  "registrableDomain": "github.com",
  "domainExpiry": "2028-10-09T18:20:50Z",
  "domainDaysUntilExpiry": 718,
  "registrar": "MarkMonitor Inc.",
  "checkedAt": "2026-10-21T22:30:00.000Z"
}

How much does it cost to check SSL certificates?

You pay $0.001 per host checked ($1 per 1,000), including the domain expiry lookup. Hosts that can't be reached are free, and with Only output problems on, healthy hosts are skipped and free too. No start fee.

Job	Hosts	Cost
Your 20 domains, checked daily	~600/month	~$0.60/month
500 client sites, weekly	~2,000/month	~$2/month
One-off audit of 10,000 domains	10,000	$10

• Apify's free plan includes $5 of monthly credit, enough for about 5,000 checks a month.
• Paid Apify plans get automatic discounts: Silver -10%, Gold and above -20%.
• Set Maximum cost per run to cap spend; the Actor stops cleanly at the limit.

SSL checker vs. the alternatives

	This Actor	Free online SSL checkers	Uptime / SSL monitoring SaaS
Bulk lists (thousands of hosts)	✅	❌ one at a time	by plan
Certificate + domain expiry in one report	✅	❌	sometimes
API, schedules, webhooks, Google Sheets	✅	❌	partial
Cost model	$1 per 1,000 checks, no subscription	free, manual	monthly subscription per monitor

Use it as an API (Python, JavaScript, cURL)

Python

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("datawright-labs/ssl-certificate-checker").call(run_input={"domains": ["example.com", "example.org"], "warnDays": 30})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["host"], item["status"], item.get("daysUntilExpiry"), item.get("domainDaysUntilExpiry"))

cURL

curl -X POST "https://api.apify.com/v2/acts/datawright-labs~ssl-certificate-checker/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" -d '{"domains":["example.com"],"onlyProblems":true}'

Use it from your AI agent (MCP)

Your AI assistant or agent can run this Actor as a tool through Apify's MCP server, so it can run SSL certificate and domain expiry checks on its own while you chat. Add this server to any MCP client that supports remote (Streamable HTTP) servers:

{
  "mcpServers": {
    "datawright-ssl-certificate-checker": {
      "url": "https://mcp.apify.com?tools=datawright-labs/ssl-certificate-checker"
    }
  }
}

On first use your browser opens to sign in to Apify (OAuth). If your client can't do OAuth, add "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" } instead. The tool shows up as datawright-labs--ssl-certificate-checker, with the same input fields as above, and the agent reads the results with get-dataset-items. Then just ask, for example:

Check the SSL certificates on these 20 domains and tell me which expire in the next 30 days.

Want several Datawright tools at once? Comma-separate them: https://mcp.apify.com?tools=datawright-labs/ssl-certificate-checker,datawright-labs/pagespeed-auditor. Runs are billed per result, exactly like normal runs.

FAQ

How do I check when an SSL certificate expires?

Add the domain and run the Actor: validTo is the exact expiry time and daysUntilExpiry the days left. Anything within warnDays gets status expiring.

Can I monitor SSL certificate expiry for many domains automatically?

Yes. Create a Schedule in Apify Console (daily is typical), turn on Only output problems, and connect an email, Slack or webhook integration so you're only notified when something needs attention.

Does it check domain expiry (WHOIS) too?

Yes, via RDAP, the structured replacement for WHOIS run by the registries. A few country-code TLDs don't publish RDAP yet; those rows include domainError and still get the full certificate check.

Why is a certificate "invalid" when my browser shows it fine?

Usually the server doesn't send its intermediate certificate (browsers sometimes fetch it themselves, many API clients don't), or the hostname isn't in the SANs. trustError gives the exact reason.

Does it support custom ports and subdomains?

Yes: enter host:port or a full URL like https://mail.example.com:8443. Each subdomain is checked separately; domain expiry is looked up once per registrable domain.

More tools from Datawright Labs

• Sitemap URL Extractor: get every URL of a site from its sitemaps.
• Bulk PageSpeed & Core Web Vitals Checker: audit PageSpeed / Lighthouse scores for many URLs.
• Website Screenshot API: bulk full-page screenshots and PDFs.
• Google Autocomplete Keyword Scraper: long-tail keyword ideas from Google, YouTube and Bing.
• Greenhouse, Lever & Ashby Jobs Scraper: normalized job feeds from 5 ATS platforms.
• App Store Top Charts & Rank Tracker: daily top free/paid/grossing app rankings with rank changes.
• Broken Link Checker: find 404s and dead links on any website, by source page.
• SPF, DMARC & DKIM Checker: bulk email domain audit of SPF (10-lookup limit), DMARC, DKIM, MX provider, BIMI and MTA-STS.

Made by Datawright Labs: reliable, fairly priced web data tools. Questions or a missing feature? Open an issue on the Issues tab; we usually reply within a day.