SSL/TLS Certificate Expiry & SANs Subdomain Drift Monitor

Inspect and monitor SSL/TLS certificates across up to 500 hosts per run using direct TLS handshakes (TLSv1.2 / TLSv1.3). Track exact days until expiration, issuing Certificate Authority (CA) changes, untrusted/mismatch errors, and newly added or removed Subject Alternative Name (SAN) subdomains across scheduled runs.

Companion Infrastructure & Domain Tools:

• Monitor DNS A / AAAA / CNAME / MX / TXT / NS / CAA record changes: DNS Record Change Monitor (invaluable_rondeau/dns-record-change-monitor)
• Audit corporate domain SPF / DMARC / DKIM / MX email security posture: B2B Domain Email Security & Deliverability Auditor (invaluable_rondeau/b2b-domain-email-security-auditor)
• Monitor OpenAPI endpoint schema drift: Third-Party API Contract Drift Monitor (invaluable_rondeau/third-party-api-contract-drift-monitor)

Key Capabilities

• Zero- outage Certificate Expiry Alerts: Flags certificates within expiryWarningDays (default 30 days) as expiring_soon and expired certificates as expired.
• SAN Subdomain Discovery & Drift: Extracts every DNS: Subject Alternative Name on the peer certificate and compares it against the previous run's Key-Value Store state (stateId), highlighting addedSans and removedSans.
• Fast & Lightweight (256 MB RAM): Uses Node.js native node:tls with 10-way concurrency—no headless browser or external API key required.

Input Example

{
  "hosts": [
    "apify.com",
    "github.com",
    "cloudflare.com"
  ],
  "expiryWarningDays": 30,
  "port": 443,
  "stateId": "production-domains",
  "timeoutMs": 4000
}

Output Example

{
  "host": "apify.com",
  "port": 443,
  "status": "valid",
  "daysRemaining": 71,
  "isExpired": false,
  "isExpiringSoon": false,
  "authorized": true,
  "subjectCn": "apify.com",
  "issuerOrg": "Google Trust Services",
  "validTo": "2026-12-30T00:00:00.000Z",
  "fingerprint256": "AA:BB:CC...",
  "protocol": "TLSv1.3",
  "sanCount": 2,
  "subjectAltNames": ["*.apify.com", "apify.com"],
  "changeType": "baseline",
  "changes": [],
  "addedSans": [],
  "removedSans": [],
  "isBillable": true,
  "checkedAt": "2026-10-20T04:00:00.000Z"
}

Pricing (Pay-Per-Event)

• Event: certificate-checked ($0.005 per reachable TLS certificate inspected).
• Unreachable hosts and malformed hostnames are saved to the Dataset for visibility but are not charged.

---

AI Agent (MCP) & Automation Integration (Claude, Cursor, n8n, Clay, Make)

This Actor is Agentic-Payment & MCP Ready (LIMITED_PERMISSIONS, 256 MB fast cold-start, synchronous JSON output).

1. Claude Desktop / Cursor / Windsurf MCP Configuration

Add to claude_desktop_config.json or .cursor/mcp.json:

{
  "mcpServers": {
    "apify-b2b-quant": {
      "command": "npx",
      "args": [
        "-y",
        "@apify/actors-mcp-server",
        "--actors",
        "invaluable_rondeau/ssl-tls-certificate-drift-monitor"
      ],
      "env": {
        "APIFY_TOKEN": "YOUR_APIFY_TOKEN"
      }
    }
  }
}

2. Synchronous HTTP Webhook (n8n, Make, Clay, Zapier, cURL)

Call the synchronous dataset endpoint to get clean JSON items in a single HTTP request:

curl -X POST "https://api.apify.com/v2/acts/invaluable_rondeau~ssl-tls-certificate-drift-monitor/run-sync-get-dataset-items?token=$APIFY_TOKEN&memory=256&clean=true" \
  -H "Content-Type: application/json" \
  -d '{}'

3. Search Keywords & Supported Workflows

Compatible with Model Context Protocol (MCP), Clay.com HTTP API enrichment, n8n HTTP Request node, Make.com, Zapier, LangChain, and OpenAI Agent SDK. Built as a high-margin, pay-per-event alternative to rigid monthly SaaS subscriptions (SSL Labs, Censys, Shodan, UptimeRobot SSL certificate expiry monitor, TLS handshake and SAN subdomain drift detector).