Bulk SSL Certificate & Domain Expiry Checker

Check the SSL certificate and the domain registration of up to 50 domains in one run. For each name you get the certificate expiry date, the days left, the issuer, and the registry renewal date read via RDAP, plus an alert as soon as either one falls inside your threshold. Two outages that are entirely predictable, on a schedule instead of in nobody's calendar.

An expired certificate takes your site down with a full-screen browser warning; an expired domain can take your email and your brand with it.

What the SSL certificate checker reads

For each domain you list:

1. Connects to port 443 and reads the live TLS certificate: expiry date, days left, issuer.
2. Looks up the domain registration expiry via RDAP — the registries' official public protocol (successor of WHOIS).
3. Raises an alert when either is within your threshold (default 30 days), is already expired, or the certificate check fails.

Domain expiry checker via RDAP

Registration expiry is read through RDAP, the registries' official public protocol and the successor of WHOIS. domainExpiresAt and domainDaysLeft come straight from the registry, never from a guess. Some country-code TLDs do not publish the date: those return null, which means the registry does not expose it, and the certificate check still runs normally. Set checkDomainExpiry to false to check certificates only.

How to use it

• Agencies: one run with all client domains, weekly schedule, alertsOnly: true piped to Slack — you'll never again learn about an expired cert from an angry client.
• Your own portfolio: side projects are exactly the domains nobody watches; 2 minutes of setup covers them forever.
• Renewal-day negotiation: domainDaysLeft across a portfolio tells you which renewals to batch this month.

Input example

{
  "domains": ["example.com", "https://client-site.fr", "shop.example.io"],
  "warnDays": 30,
  "alertsOnly": true
}

The defaults work as-is.

Output example

{
  "domain": "client-site.fr",
  "certValidTo": "2026-07-16T00:00:00.000Z",
  "certDaysLeft": 10,
  "certIssuer": "Let's Encrypt",
  "domainExpiresAt": "2027-03-01T00:00:00.000Z",
  "domainDaysLeft": 238,
  "hasAlert": true,
  "alerts": ["certificate expires in 10 day(s)"],
  "checkedAt": "2026-07-06T16:00:00.000Z"
}

A SUMMARY record gives the fleet picture: domains checked, alerts, and the single closest expiry across everything you monitor.

Data returned for each domain

Field	What it holds
certValidTo	Certificate expiry date read from the live TLS handshake
certDaysLeft	Days remaining on the certificate
certIssuer	Certificate authority that issued it
domainExpiresAt	Registry expiry date via RDAP, null if not published
domainDaysLeft	Days remaining on the registration
hasAlert / alerts	Whether something crossed your threshold, and what
checkedAt	Timestamp of the check

FAQ

Domain expiry shows null? Some country-code TLDs don't expose expiration via RDAP. The certificate check always works; null means "registry doesn't publish it", never a guess.

Why does it alert every run? By design — an approaching expiry should nag until fixed. Fix it and the alert stops.

Wildcard/multi-SAN certificates? The check reads whatever certificate the server presents for the domain name you listed, exactly like a visitor's browser would.

Fair use & data

• Uses only a standard TLS handshake (the same thing every browser does) and RDAP, the registries' official public lookup protocol.
• No personal data collected — registrant contact details are neither requested nor stored.
• Hard cap of 50 domains per run keeps runs bounded and predictable.