SSL/TLS Certificate Expiry Monitor

SSL/TLS certificate expiry monitoring for any HTTPS host — bulk TLS checks that alert you before certificates expire, plus detection of unexpected issuer / SAN / fingerprint changes (CA migrations, mis-issuance, MITM). Pure protocol: it opens a TLS handshake and reads the certificate. No scraping, no anti-bot, no personal data.

Why

A single silently-expired certificate takes down checkout, APIs, or an entire site — and the industry is moving to short-lived (≤200-day, trending 90-day) certificates, multiplying renewal churn. This Actor is the cheap insurance: schedule it, and know days ahead.

Use cases

• Fleet expiry monitoring — watch every domain/subdomain/API host you own; alert at N days.
• Change / tamper detection — flag when a cert's issuer, SAN set, or SHA-256 fingerprint changes between runs.
• CA-migration & compliance tracking — verify a planned issuer switch actually rolled out everywhere.
• Vendor/counterparty checks — monitor third-party endpoints you depend on.

Input

field	type	default	notes
domains	string[] (required)	—	Hostnames, one per line. host:port supported (default 443). https:// is stripped.
warningDays	integer	30	Emit an expiry alert when a cert expires within this many days.
detectChanges	boolean	true	Compare issuer/SAN/fingerprint to the previous run (baseline stored in the Actor's key-value store).
timeoutSecs	integer	12	Per-host TLS handshake timeout.

{ "domains": ["example.com", "api.stripe.com:443", "badssl.com"], "warningDays": 30, "detectChanges": true }

Output (one dataset item per host)

status (ok|error), host, port, subject, issuer, validFrom, validTo, daysToExpiry, expiring, expired, fingerprint256, serialNumber, san, changed (+ previousFingerprint/previousIssuer when changed), or error on failure. Real item from a smoke run:

{
  "status": "ok",
  "host": "example.com",
  "port": 443,
  "subject": "example.com",
  "issuer": "SSL Corporation",
  "validFrom": "Jul 29 22:10:08 2026 GMT",
  "validTo": "Oct 27 22:17:21 2026 GMT",
  "daysToExpiry": 48,
  "expiring": false,
  "expired": false,
  "fingerprint256": "61:53:A9:6F:D1:A6:AB:7F:4D:43:8F:C3:49:32:48:42:99:D0:72:9D:91:40:B3:A1:26:BB:2F:9C:07:B0:22:00",
  "serialNumber": "0624D0AB311558780B7D5213B9631831",
  "san": "DNS:example.com, DNS:*.example.com",
  "changed": false
}

An expired host comes back with expired: true, expiring: true, and a negative daysToExpiry — that is the row your webhook should alert on.

Pricing (pay-per-event) & worked cost example

Event	Price (USD)	When
actor-start	0.01	once per run
domain-checked	0.0015	per host with a certificate successfully read
expiry-alert	0.02	per host inside the warning window or already expired
cert-changed	0.02	per host whose issuer/SAN/fingerprint changed vs last run

Failed handshakes are never charged. Worked example — a daily run over 100 hosts with 5 in the warning window: 0.01 + 100×0.0015 + 5×0.02 = $0.26. Measured platform compute for that run is well under $0.01 (a TLS handshake is milliseconds; first 5s of compute is subsidized) — so platform cost is <4% of event revenue.

Integrate

Run on a schedule (e.g. daily), then fan alerts out via Apify webhooks, the API, MCP, or Make/n8n — trigger a downstream notification whenever an item has expiring: true or changed: true.

Limitations

• Reads the leaf certificate presented for the given SNI; it does not perform full chain-path validation or OCSP/CRL revocation checks.
• Change detection needs a baseline — the first run for a host records the baseline; changes are flagged from the second run on.
• Hosts that require client certs, non-standard TLS, or that block the connection return a structured error item.
• Optional Certificate-Transparency enrichment (planned) will use first-party RFC-6962 log APIs, never third-party scraping.

FAQ

How to check SSL certificate expiry date for a domain?

Pass the hostname to the domains field (one per line) and run the Actor. The output includes validTo, daysToExpiry, and an expiring boolean flag — no manual OpenSSL commands needed.

What happens when an SSL certificate expires?

The Actor marks it as expired: true and emits an expiry-alert event. Schedule daily runs and use Apify webhooks to forward these alerts to Slack, email, PagerDuty, or any webhook endpoint.

How often should I check SSL certificates?

For certificates with 30–90 day validity (the industry trend), daily checks are recommended. The Actor is cheap enough for per-domain checking at $0.0015 per domain-checked event — running 100 domains daily costs roughly $0.26 per run.

Can I monitor internal or non-public hosts?

Yes. The Actor connects to any host:port reachable from the Apify platform. Private hosts behind a VPN are not reachable unless exposed to the internet, but any HTTPS service with a public IP works.

Does this tool detect TLS certificate changes?

Yes. With detectChanges: true (the default), the Actor compares issuer, SAN list, and SHA-256 fingerprint against a stored baseline from the previous run. Any mismatch emits a cert-changed alert — useful for catching CA migrations, mis-issued certificates, or man-in-the-middle scenarios.

Related tools from gp005

• /gp005/security-headers-auditor — scan any URL for CSP, HSTS, X-Frame-Options, and 15+ other HTTP security headers with OWASP-aligned grading.
• /gp005/email-deliverability-auditor — audit MX, SPF, DKIM, DMARC, DNSSEC, MTA-STS, TLS-RPT, and BIMI records via DNS-over-HTTPS.
• /gp005/geo-llms-auditor — check robots.txt, llms.txt, sitemap.xml, and on-page metadata for generative-AI discoverability.
• /gp005/edgar-xbrl-fundamentals — pull 10-K, 10-Q, 8-K filings and financial concepts from SEC EDGAR via its official APIs.