SSL Certificate Checker — Issuer, SANs, Expiry, Chain JSON

Send hostnames, get each TLS certificate's validity, issuer, subject alternative names and days until it expires, with a warning when expiry is close.

You give it	You get back	You pay (Free plan)
One host or URL, or a list of up to 50; port and warning window optional	Per host: valid, authorized, subject, issuer, SANs, valid from/to, days to expiry, expired flag	$0.0008 per host

Pay per result only: no subscription, no start fee. An unreachable host or refused connection returns {ok:false, error} and is not charged. Paid Apify plans get Store discounts on the price above.

Try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "host": "github.com",
  "hosts": [
    "cloudflare.com",
    "wikipedia.org"
  ]
}

Real output from that exact input (run on 2026-09-24; long arrays shortened to a few entries and long text cut for display):

[
  {
    "host": "cloudflare.com",
    "port": 443,
    "valid": true,
    "authorized": true,
    "authorizationError": null,
    "subject": "CN=cloudflare.com",
    "issuer": "CN=WE1, O=Google Trust Services, C=US",
    "commonName": "cloudflare.com",
    "san": [
      "DNS:cloudflare.com",
      "DNS:ns.cloudflare.com"
    ],
    "validFrom": "2026-09-05T22:29:39.000Z",
    "validTo": "2026-12-04T23:29:33.000Z",
    "daysToExpiry": 71,
    "expired": false,
    "expiringSoon": false,
    "warnDays": 21,
    "notYetValid": false,
    "selfSigned": false,
    "serialNumber": "D509925C8DB10E1913A3A1CB1C7B05AB",
    "fingerprint256": "96:10:34:EB:E7:3C:0A:AB:92:EE:5C:12:7A:42:65:B9:9A:BC:36:CD:F0:B5:3B:82:B1:07:88:E0:87:A7:2A:14",
    "keyUsage": [
      "1.3.6.1.5.5.7.3.1"
    ],
    "keyType": "prime256v1",
    "bits": 256,
    "protocol": "TLSv1.3",
    "chainLength": 3,
    "chain": [
      {
        "subject": "CN=cloudflare.com",
        "issuer": "CN=WE1, O=Google Trust Services, C=US",
        "validFrom": "2026-09-05T22:29:39.000Z",
        "validTo": "2026-12-04T23:29:33.000Z",
        "fingerprint256": "96:10:34:EB:E7:3C:0A:AB:92:EE:5C:12:7A:42:65:B9:9A:BC:36:CD:F0:B5:3B:82:B1:07:88:E0:87:A7:2A:14"
      },
      {
        "subject": "CN=WE1, O=Google Trust Services, C=US",
        "issuer": "CN=GTS Root R4, O=Google Trust Services LLC, C=US",
        "validFrom": "2023-12-13T09:00:00.000Z",
        "validTo": "2029-02-20T14:00:00.000Z",
        "fingerprint256": "1D:FC:16:05:FB:AD:35:8D:8B:C8:44:F7:6D:15:20:3F:AC:9C:A5:C1:A7:9F:D4:85:7F:FA:F2:86:4F:BE:BF:96"
      }
    ],
    "ok": true
  }
]

Everything about a host's live TLS certificate as clean JSON — issuer, SANs, days to expiry, full chain walk, negotiated protocol — for one host or up to 200 per run. Online, by API, or as an agent tool via Apify MCP.

This actor performs a real TLS handshake (SNI-aware, any port), reads the presented certificate even when validation fails (so you can diagnose self-signed and expired certs, not just detect them), and walks the issuer chain. Useful for expiry monitoring, migration verification, security audits, and inventorying certs across a host list.

What you get

• valid / authorized / authorizationError — the handshake verdict and, when it fails, exactly why
• issuer / subject / commonName / san — who issued it and what names it covers
• validFrom / validTo / daysToExpiry / expired / notYetValid — the full expiry picture
• selfSigned, serialNumber, fingerprint256, keyType / bits
• protocol — negotiated TLS version (e.g. TLSv1.3)
• chain / chainLength — every certificate up the issuer chain with its own validity window
• Fail-soft: an unreachable host or refused connection never fails the run — it returns {ok: false, error} and is never charged.

Input

{ "hosts": ["github.com", "internal.example.com:8443"], "maxHosts": 50 }

Or a single host: { "host": "github.com" }. URLs are accepted; custom port supported.

Output (real run, trimmed)

{
  "host": "github.com",
  "port": 443,
  "ok": true,
  "valid": true,
  "issuer": "CN=Sectigo Public Server Authentication CA DV E36, O=Sectigo Limited, C=GB",
  "commonName": "github.com",
  "validTo": "2026-09-30T23:59:59.000Z",
  "daysToExpiry": 54,
  "expired": false,
  "selfSigned": false,
  "keyType": "prime256v1",
  "protocol": "TLSv1.3",
  "chainLength": 3
}

Pricing

$0.0008 per host checked. No start fee. Unreachable hosts and connection failures are never charged — you pay only when a certificate was actually inspected.

Measured against store incumbents (2026-08-07): andok/ssl-certificate-monitor charges $0.001 per item, santamaria-automations $0.001 start + $0.001 per result, bgfc97 $0.003 per host, automation-lab $0.035 per start (19 users). A 100-host inventory here costs $0.08.

Honest limits

• One certificate per host:port — the one presented for the SNI name you pass. Multi-cert setups (different certs per SNI) need one check per hostname, which is how the pricing works anyway.
• valid reflects Node's CA bundle at run time; a cert chained to a niche private CA reports authorized: false with the exact authorizationError — inspect, then decide.
• Certificate transparency logs, OCSP/revocation status, and cipher-suite enumeration are out of scope.

FAQ

Can it check non-HTTPS services? Yes — any TLS endpoint: mail.example.com:465 (SMTPS), db.example.com:5432 won't work (Postgres uses STARTTLS-style negotiation), but any direct-TLS port does. Default port is 443.

What do I get for an expired or self-signed cert? The full certificate details plus expired: true or selfSigned: true and the authorizationError — the actor reads certs that fail validation instead of erroring out, which is the whole point of diagnosing.

How do I monitor expiry across my fleet? Run your host list on a schedule and alert on daysToExpiry < 30. One 100-host sweep costs $0.08.

Why is the SAN list important? It is what the cert actually covers. A renewal that dropped a subdomain from the SANs breaks that subdomain silently — comparing SAN lists across runs catches it.

Why did some rows come back ok: false? Those hosts did not complete a TLS handshake (DNS failure, timeout, connection refused). Recorded with the exact error, never charged.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~ssl-certificate-checker/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"hosts": ["yourdomain.com", "api.yourdomain.com"]}'

Agents: connect Apify MCP and call the EliAI/ssl-certificate-checker tool.

• Capability: live TLS certificate inspection of one or many hosts — issuer, SANs, expiry, chain, protocol
• Required input: host/url (string) or hosts/urls (array); optional port
• Returns: one JSON record per host; valid + daysToExpiry summarize the verdict
• Bounded: maxHosts caps the run; failures isolate per host
• Side effects: none (a single TLS handshake per host, immediately closed)

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/ssl-certificate-checker
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~ssl-certificate-checker/run-sync-get-dataset-items
• Pay with x402, without an Apify account. This Actor is whitelisted for agentic payments, so an agent holding USDC on Base can buy a prepaid token and spend it here. The minimum purchase is $1, the token balance is an absolute spending cap, and it expires 14 days after purchase.
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.

Who uses it

• SREs monitoring days-to-expiry across 200 hosts so no certificate lapses
• Engineers verifying a new certificate and its SANs after a CDN or load-balancer migration
• Security auditors inventorying issuers and TLS protocol versions across a host list
• Support engineers diagnosing a customer's self-signed or expired certificate
• MSPs checking client sites on non-standard ports for chain problems

Changelog

• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.