SSL Certificate & Security Headers Checker – Expiry Monitor

Check the SSL/TLS certificates of hundreds of domains in one run and get warned before they expire. Optionally grade each site's HTTP security headers. No browser, very cheap.

• Certificate: valid from/to, days remaining, expiresSoon flag, issuer, common name, all SAN domains, serial number, SHA-256 fingerprint, key type and size
• Validation: trusted chain, hostname match, self-signed, expired – with the exact problem (CERT_HAS_EXPIRED, ERR_TLS_CERT_ALTNAME_INVALID, DEPTH_ZERO_SELF_SIGNED_CERT …)
• Chain: intermediate and root CAs with their expiry dates
• Connection: TLS version (TLSv1.2/1.3) and cipher
• Security headers: HSTS (max-age, includeSubDomains, preload), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, missing headers, grade A–F, HTTP→HTTPS redirect
• Delta mode: schedule it daily and receive only hosts whose certificate, validity, expiry warning, error or header grade changed

Use cases

• SSL expiry monitoring for all your domains and subdomains – with alerts via email, Slack or webhook through Apify integrations
• Agencies and IT service providers: check all client websites at once
• Security reviews: find weak TLS settings, missing HSTS or missing security headers
• Sales: spot websites with expired certificates or poor security grades

Input example

{
  "hosts": ["example.com", "shop.example.com", "mail.example.com:8443"],
  "warnDays": 21,
  "checkSecurityHeaders": true
}

For monitoring, add "mode": "delta" and create a daily schedule.

Output (one item)

{
  "host": "example.com",
  "port": 443,
  "valid": true,
  "authorizationError": null,
  "hostnameMatches": true,
  "daysRemaining": 64,
  "expiresSoon": false,
  "validFrom": "2026-08-15T00:00:00.000Z",
  "validTo": "2026-12-16T23:59:59.000Z",
  "issuer": "Let's Encrypt / R11",
  "subjectCN": "example.com",
  "subjectAltNames": ["example.com", "www.example.com"],
  "selfSigned": false,
  "protocol": "TLSv1.3",
  "cipher": "TLS_AES_256_GCM_SHA384",
  "keyType": "ec",
  "keyBits": 256,
  "chain": [{ "subject": "Let's Encrypt / R11", "issuer": "Internet Security Research Group / ISRG Root X1", "validTo": "2027-03-12T23:59:59.000Z" }],
  "error": null,
  "httpsStatus": 200,
  "httpRedirectsToHttps": true,
  "hsts": { "maxAge": 31536000, "includeSubDomains": true, "preload": false },
  "missingSecurityHeaders": ["permissions-policy"],
  "headersScore": 90,
  "headersGrade": "A",
  "fetchedAt": "2026-10-13T14:00:00.000Z"
}

Hosts that cannot be reached are returned with valid: false and error (e.g. DNS_NOT_FOUND, CONNECTION_REFUSED, TIMEOUT). In delta mode daysRemaining and the raw header values (securityHeaders, whose CSP nonces change on every request) are omitted so that only real changes are reported.

Header grade

Points: HSTS 25, Content-Security-Policy 25, X-Content-Type-Options 15, X-Frame-Options (or CSP frame-ancestors) 15, Referrer-Policy 10, Permissions-Policy 10. Grade A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 45, otherwise F.

Pricing

Pay per event: USD 0.75 per 1,000 checked hosts (event result), with lower prices on higher Apify subscription plans. There is no start fee. Users on the Apify Free plan are limited to 50 hosts per run.

How it works and limits

• One TLS handshake per host (SNI = host name) and, with header checks enabled, one request to https://host/ and one to http://host/. At most 1 request per second per host, 10 hosts in parallel.
• Certificates are read but not trusted blindly: valid is true only if the chain is trusted by Node.js' CA store, the host name matches and the certificate has not expired.
• Security headers are taken from the final response after redirects. If the certificate is invalid, the header check fails with headersError.
• Only technical certificate data is returned. Organisation and location fields of the certificate subject are not returned, and the issuer of self-signed certificates is omitted because it can name a person.

Responsibility

Check hosts that you own or are allowed to test. The actor performs a normal TLS handshake and normal HTTP requests, like a browser visiting the homepage. This actor is not affiliated with any certificate authority or with the websites checked.

Impressum / Legal notice

Anbieter dieses Actors (Angaben gemäß § 5 DDG) / Provider of this actor:

Friedrich Köhler
Spatzenweg 7
04720 Döbeln
Deutschland
E-Mail: actorcreater_010@web.de