SSL Certificate Monitor — Expiry Alerts, CT Logs, Subdomain Discovery

Monitor SSL/TLS certificates for your domains at scale. Get expiry alerts before certificates cause outages, inspect certificate chains and cipher suites, and discover subdomains via Certificate Transparency logs — all without any API key.

---

Use Cases

• DevOps & SRE: Scheduled cert expiry monitoring for your entire domain portfolio. Never be surprised by an expired cert again.
• Security teams: Subdomain enumeration via public CT logs — discover shadow IT, forgotten staging environments, or unauthorized certificates issued for your domain.
• Compliance: Audit TLS configuration (cipher suite, TLS version) across all public-facing services.
• Penetration testing & bug bounties: Map the full attack surface of a target's subdomains using CT log data.
• MSPs & agencies: Monitor client domains from a single Apify run.

---

How It Works

1. Direct TLS Certificate Check (Python ssl module)

Connects directly to domain:443 (or your configured port) and inspects the certificate:

• Expiry date and days remaining
• Subject (CN, O, OU) and Issuer (CN, O)
• Subject Alternative Names (SAN)
• Serial number
• Cipher suite name, TLS protocol version, key bits

No third-party API or proxy required — uses Python's built-in ssl module.

2. Certificate Transparency Log Discovery (crt.sh)

Queries https://crt.sh/?q=%.{domain}&output=json — a public CT log aggregator run by Sectigo. Returns all certificates ever issued for the domain and its subdomains, enabling passive subdomain discovery without DNS brute-forcing.

Note: crt.sh data reflects what certificate authorities have logged to public CT logs. Wildcard certificates (*.example.com) are excluded from subdomain results; only explicitly-named certificates appear.

---

Comparison

Tool	Cost	Subdomain Discovery	Cert Expiry	No API Key
This Actor	$0.002/domain + $0.001/subdomain	CT logs (crt.sh)	Yes	Yes
Cert expiry SaaS (e.g. Uptime Robot)	$50+/mo	No	Yes	No
Shodan	$69+/mo	Yes (paid)	Partial	No
certspotter	Free tier limited	CT logs	Yes	No

---

Input

Field	Type	Default	Description
domains	array of string	required	Domains to check, e.g. ["example.com", "api.example.com"]
checkSubdomains	boolean	true	Discover subdomains via crt.sh CT logs
expiryWarningDays	integer	30	Flag certificates expiring within N days
port	integer	443	TLS port to connect to
maxSubdomains	integer	100	Max unique subdomains to return per domain

Example Input

{
  "domains": ["example.com", "github.com"],
  "checkSubdomains": true,
  "expiryWarningDays": 30,
  "port": 443,
  "maxSubdomains": 100
}

---

Output

The actor pushes three types of records to the dataset.

domain-cert — Certificate check result

{
  "_type": "domain-cert",
  "domain": "example.com",
  "port": 443,
  "ok": true,
  "not_before": "2024-01-15T00:00:00+00:00",
  "not_after": "2025-01-15T00:00:00+00:00",
  "days_until_expiry": 42,
  "is_expired": false,
  "is_expiring_soon": false,
  "expiry_warning_days": 30,
  "subject_cn": "example.com",
  "subject_org": "Internet Corporation for Assigned Names and Numbers",
  "issuer_cn": "DigiCert TLS RSA SHA256 2020 CA1",
  "issuer_org": "DigiCert Inc",
  "san": ["example.com", "www.example.com"],
  "san_count": 2,
  "serial_number": "0x0F7E",
  "cipher_name": "TLS_AES_256_GCM_SHA384",
  "tls_version": "TLSv1.3",
  "cipher_bits": 256,
  "checked_at": "2025-06-01T10:00:00+00:00"
}

On failure:

{
  "_type": "domain-cert",
  "domain": "expired.badssl.com",
  "ok": false,
  "error": "SSL verification failed: certificate has expired"
}

subdomain — CT log subdomain entry

{
  "_type": "subdomain",
  "root_domain": "example.com",
  "name": "mail.example.com",
  "issuer_name": "C=US, O=Let's Encrypt, CN=R3",
  "not_after": "2025-09-01T12:00:00",
  "logged_at": "2024-06-10T08:23:11.456",
  "cert_id": 12345678
}

summary — Run summary (last record)

{
  "_type": "summary",
  "total_domains_checked": 2,
  "expiring_soon": ["staging.example.com"],
  "expiring_soon_count": 1,
  "expired": [],
  "expired_count": 0,
  "total_subdomains_discovered": 47,
  "expiry_warning_days": 30,
  "checked_at": "2025-06-01T10:00:00+00:00"
}

---

Pricing

Event	Price	When
Actor start	$0.001	Once per run
domain-checked	$0.002	Per domain TLS checked
subdomain-discovered	$0.001	Per unique subdomain found in CT logs

Example: Checking 10 domains, discovering 50 subdomains = $0.001 + (10 × $0.002) + (50 × $0.001) = $0.071

---

Scheduling

Run this actor on a schedule (e.g. daily) to get continuous cert expiry alerts. Combine with Apify webhooks to send Slack or email notifications when expiring_soon_count > 0.

---

Limitations

• crt.sh rate limits: Very large domains (e.g. google.com) may have thousands of CT log entries; use maxSubdomains to cap results.
• Private/internal domains: The direct TLS check works on any reachable host, but crt.sh only indexes publicly-logged certificates.
• CT log completeness: Not all CAs log to all CT logs; crt.sh aggregates the major ones (Google, Cloudflare, DigiCert, etc.).
• Wildcard certs: Wildcards (*.example.com) are filtered from subdomain results since they don't reveal specific hostnames.

Keywords: SSL certificate, TLS monitoring, expiry checker, certificate chain, ciphers, subdomain discovery, Certificate Transparency, security

---

Related actors

• Shodan Attack Surface Mapper — Full attack surface including open ports and services beyond SSL
• Domain DNS Checker — DNS records for domains whose SSL certificates are monitored here
• CVE Vulnerability Tracker — CVE alerts for vulnerabilities in cipher suites and TLS versions found here

Feedback

If this actor powers your security monitoring, a review helps others find it: Leave a review on Apify Store