# SSL/TLS Certificate Expiry Monitor (`gp005/tls-cert-monitor`) Actor Bulk-check TLS certificates for any HTTPS hosts: days-to-expiry, expiry alerts, and issuer/SAN/fingerprint change detection. Pure protocol, no scraping. - **URL**: https://apify.com/gp005/tls-cert-monitor.md - **Developed by:** [Geo](https://apify.com/gp005) (community) - **Categories:** Developer tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $1.50 / 1,000 domain checkeds This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## SSL/TLS Certificate Expiry Monitor Bulk-check TLS certificates for **any** HTTPS hosts and get alerted **before** they expire — plus catch unexpected issuer / SAN / fingerprint changes (CA migrations, mis-issuance, MITM). Pure protocol: it opens a TLS handshake and reads the certificate. **No scraping, no anti-bot, no personal data.** ### Why A single silently-expired certificate takes down checkout, APIs, or an entire site — and the industry is moving to short-lived (≤200-day, trending 90-day) certificates, multiplying renewal churn. This Actor is the cheap insurance: schedule it, and know days ahead. ### Use cases - **Fleet expiry monitoring** — watch every domain/subdomain/API host you own; alert at N days. - **Change / tamper detection** — flag when a cert's issuer, SAN set, or SHA-256 fingerprint changes between runs. - **CA-migration & compliance tracking** — verify a planned issuer switch actually rolled out everywhere. - **Vendor/counterparty checks** — monitor third-party endpoints you depend on. ### Input | field | type | default | notes | |---|---|---|---| | `domains` | string[] (required) | — | Hostnames, one per line. `host:port` supported (default 443). `https://` is stripped. | | `warningDays` | integer | 30 | Emit an expiry alert when a cert expires within this many days. | | `detectChanges` | boolean | true | Compare issuer/SAN/fingerprint to the previous run (baseline stored in the Actor's key-value store). | | `timeoutSecs` | integer | 12 | Per-host TLS handshake timeout. | ```json { "domains": ["example.com", "api.stripe.com:443", "badssl.com"], "warningDays": 30, "detectChanges": true } ```` ### Output (one dataset item per host) `status` (`ok`|`error`), `host`, `port`, `subject`, `issuer`, `validFrom`, `validTo`, `daysToExpiry`, `expiring`, `expired`, `fingerprint256`, `serialNumber`, `san`, `changed` (+ `previousFingerprint`/`previousIssuer` when changed), or `error` on failure. ### Pricing (pay-per-event) & worked cost example | Event | Price (USD) | When | |---|--:|---| | `actor-start` | 0.01 | once per run | | `domain-checked` | 0.0015 | per host with a certificate successfully read | | `expiry-alert` | 0.02 | per host inside the warning window or already expired | | `cert-changed` | 0.02 | per host whose issuer/SAN/fingerprint changed vs last run | **Failed handshakes are never charged.** Worked example — a daily run over **100 hosts** with 5 in the warning window: `0.01 + 100×0.0015 + 5×0.02 = $0.26`. Measured platform compute for that run is well under **$0.01** (a TLS handshake is milliseconds; first 5s of compute is subsidized) — so platform cost is **<4%** of event revenue. ### Integrate Run on a **schedule** (e.g. daily), then fan alerts out via Apify **webhooks**, the **API**, **MCP**, or **Make/n8n** — trigger a downstream notification whenever an item has `expiring: true` or `changed: true`. ### Limitations - Reads the **leaf** certificate presented for the given SNI; it does not perform full chain-path validation or OCSP/CRL revocation checks. - **Change detection needs a baseline** — the first run for a host records the baseline; changes are flagged from the second run on. - Hosts that require client certs, non-standard TLS, or that block the connection return a structured `error` item. - Optional Certificate-Transparency enrichment (planned) will use **first-party RFC-6962 log APIs**, never third-party scraping. # Actor input Schema ## `domains` (type: `array`): Hostnames to check, one per line. Optionally add a port as host:port (defaults to 443). Schemes like https:// are stripped automatically. ## `warningDays` (type: `integer`): Emit an expiry alert when a certificate expires within this many days. ## `detectChanges` (type: `boolean`): Compare issuer / SAN / SHA-256 fingerprint against the previous run for each host and flag changes (uses the Actor's key-value store as the baseline). ## `timeoutSecs` (type: `integer`): TLS handshake timeout per host. ## Actor input object example ```json { "domains": [ "example.com", "api.stripe.com:443" ], "warningDays": 30, "detectChanges": true, "timeoutSecs": 12 } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "example.com", "github.com", "badssl.com" ] }; // Run the Actor and wait for it to finish const run = await client.actor("gp005/tls-cert-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "example.com", "github.com", "badssl.com", ] } # Run the Actor and wait for it to finish run = client.actor("gp005/tls-cert-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "example.com", "github.com", "badssl.com" ] }' | apify call gp005/tls-cert-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=gp005/tls-cert-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "SSL/TLS Certificate Expiry Monitor", "description": "Bulk-check TLS certificates for any HTTPS hosts: days-to-expiry, expiry alerts, and issuer/SAN/fingerprint change detection. Pure protocol, no scraping.", "version": "0.1", "x-build-id": "ycPV3764be2810M2u" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/gp005~tls-cert-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-gp005-tls-cert-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/gp005~tls-cert-monitor/runs": { "post": { "operationId": "runs-sync-gp005-tls-cert-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/gp005~tls-cert-monitor/run-sync": { "post": { "operationId": "run-sync-gp005-tls-cert-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domains" ], "properties": { "domains": { "title": "Hosts to check", "type": "array", "description": "Hostnames to check, one per line. Optionally add a port as host:port (defaults to 443). Schemes like https:// are stripped automatically.", "items": { "type": "string" } }, "warningDays": { "title": "Expiry warning window (days)", "minimum": 1, "maximum": 365, "type": "integer", "description": "Emit an expiry alert when a certificate expires within this many days.", "default": 30 }, "detectChanges": { "title": "Detect certificate changes", "type": "boolean", "description": "Compare issuer / SAN / SHA-256 fingerprint against the previous run for each host and flag changes (uses the Actor's key-value store as the baseline).", "default": true }, "timeoutSecs": { "title": "Per-host timeout (seconds)", "minimum": 3, "maximum": 60, "type": "integer", "description": "TLS handshake timeout per host.", "default": 12 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```