SSL Certificate Expiry Checker: never miss a renewal

Check the TLS certificate of any list of public domains in one run and find out which ones are expired, invalid or about to expire. For each host you get the expiry date, days left, issuer, alternative names and TLS version, so you can catch renewals before visitors see a browser warning.

What you get

Field	What it tells you
host / port	The host checked and the port (default 443).
status	ok, expiring_soon, expired or invalid.
days_left	Days until the certificate expires.
valid_from / valid_until	Certificate validity dates.
subject_cn / issuer	Certificate subject and issuing authority.
alt_names	Subject alternative names covered by the certificate.
tls_version / cipher	Negotiated TLS version and cipher.
error	Why a certificate is invalid (wrong hostname, untrusted chain, expired).

Example row:

{"host": "apify.com", "port": 443, "status": "ok", "days_left": 95, "valid_until": "2027-01-16", "subject_cn": "*.apify.com", "issuer": "Amazon", "tls_version": "TLSv1.3"}

How to use it in 3 steps

1. Paste domains or URLs, one per line (example.com or https://example.com:8443, up to 2,000).
2. Set the warning threshold in days (default 30): certificates expiring sooner get expiring_soon.
3. Run it and sort by days_left. Schedule it weekly and connect it to Slack, email or Sheets to get alerts.

Pricing

$2 per 1,000 hosts (1,000 hosts = $2). Hosts that do not resolve, point to internal networks or refuse the connection are skipped and not charged.

Integrations

• Apify API: call the Actor from any language and read the dataset as JSON, CSV or Excel.
• Make, n8n and Zapier: use the official Apify modules, run this Actor and map the output rows.
• Google Sheets: export the dataset to Sheets from the run page, or schedule runs and append the rows.
• MCP (Claude, Cursor): add the Apify MCP server https://mcp.apify.com with actors=kadro/ssl-certificate-expiry-checker. Example prompt: "Check these 100 domains and list every certificate that expires in the next 45 days."

FAQ

Does it work with internal or private hosts? No. Only public hosts are accepted; internal addresses are rejected.

What does invalid mean? The certificate fails validation: expired, wrong hostname or untrusted chain. The reason is in error.

Is it a security scan? No. It opens one standard TLS connection to the port you give and reads the certificate; it does not scan or probe anything else.

Can I get alerts? Schedule the Actor in Apify and connect the dataset to Make, n8n, Zapier or Slack.

What is not charged? Hosts that cannot be reached or are blocked.

Limitations

• Only the certificate presented on the given port is checked, not the whole chain details.
• Hosts are checked one after another, so very large lists take time.
• No OCSP or revocation check.
• Max 2,000 hosts per run.

Other Kadro tools

• Bulk Domain WHOIS & DNS Lookup: domain expiry and DNS for the same list.
• Website Tech Stack Detector: what each site runs on.
• Bulk Domain Availability Checker: find free domains.
• Dedup & Merge Datasets: combine host lists.

Found it useful? Please leave a review ⭐ — it helps a lot. Bugs or feature ideas: open an issue, I answer within 24 h.