SSL Certificate Checker & Security Headers Scanner (Bulk)

Bulk SSL/TLS certificate checker: expiry date, days remaining, issuer, SANs, chain trust, TLS version, HTTP/2 – plus HSTS, CSP and security headers grade with fixes. Perfect for monitoring and audits.

What does it do?

Check SSL/TLS certificates and HTTP security headers for any list of hosts. Each result includes expiry date and days remaining, issuer, subject and SANs, wildcard detection, hostname match, chain trust, self-signed detection, TLS version & cipher, HTTP/2 support, key size and SHA-256 fingerprint. Optionally it grades HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, the HTTP→HTTPS redirect and version disclosure – with a clear fix for every issue.

Why use it?

• Certificate expiry monitoring for hundreds of domains (schedule it daily and alert on expiring_soon).
• Security audits and pentest pre-checks for clients and prospects.
• Agencies and hosting providers: verify every customer site after renewals or migrations.
• Lead generation: find companies with expired or misconfigured certificates.

Quick start

1. Click Try for free / Start.
2. Paste your list (the example input already works – just press Start).
3. Download results as JSON, CSV, Excel or HTML, or use the API, schedules and integrations (Make, Zapier, n8n, Slack, Google Sheets…).

Input example

{
  "domains": ["apify.com", "github.com", "expired.badssl.com"],
  "checkSecurityHeaders": true,
  "expiryWarningDays": 30
}

Output example

{
  "host": "example.com",
  "sslValid": true,
  "expiryStatus": "ok",
  "daysRemaining": 71,
  "validTo": "2027-01-09T23:59:59.000Z",
  "issuer": "Let's Encrypt",
  "subjectAltNames": ["example.com", "www.example.com"],
  "tlsProtocol": "TLSv1.3",
  "http2": true,
  "headersGrade": "B",
  "missingHeaders": ["content-security-policy"],
  "issues": [{ "severity": "high", "code": "MISSING_CONTENT_SECURITY_POLICY", "fix": "Define a Content-Security-Policy." }]
}

Pricing

Pay only for results: $3.00 per 1,000 hosts (pay-per-event). No subscription. Platform usage is included in the price. You can set a maximum cost per run and the Actor stops before exceeding it.

FAQ

Does it work with expired or self-signed certificates?

Yes. The certificate is always read (verification is reported, not enforced), so broken certificates are reported instead of failing.

Can I schedule it?

Yes – use Apify Schedules and an integration (Slack, email, webhook) to alert when expiryStatus is expiring_soon or expired.

Are unreachable hosts charged?

Unreachable hosts are returned with expiryStatus: unreachable because that is useful monitoring information.

Legal & responsible use

This Actor only accesses publicly available data and official public APIs, respects robots.txt where applicable and paces its requests. You are responsible for using the results in line with applicable laws (e.g. GDPR/CCPA) and the terms of the data sources.

Support

Found a bug or need a feature? Open an issue on the Actor’s Issues tab – we usually reply within 24 hours. Check our other tools: Website SEO & Broken Link Auditor, B2B Lead & Tech Stack Intelligence, Shopify Product Scraper and ATS Jobs Scraper.