SSL Certificate Expiry Checker - Bulk TLS Cert Monitor
Pricing
from $1.00 / 1,000 hosts
SSL Certificate Expiry Checker - Bulk TLS Cert Monitor
Bulk SSL/TLS certificate checker: days until expiry, expiry date, issuer, hostname match, trusted chain and TLS version for each domain. One TLS handshake per host, no page download. Schedule it as a cert-expiry monitor. $1 per 1,000 hosts.
Pricing
from $1.00 / 1,000 hosts
Rating
0.0
(0)
Developer
Lentic Labs
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
10 hours ago
Last modified
Categories
Share
SSL Certificate Expiry Checker - Bulk TLS Certificate Monitor
Check SSL/TLS certificate expiry for hundreds or thousands of hosts in one run and catch expiring certificates before they cause an outage. For each host you get days left, expiry date, issuer, hostname match, trusted chain and TLS version. It does a real TLS handshake with SNI, so you see the certificate the live endpoint actually serves, not the file your renewal job wrote. $1 per 1,000 hosts.
To use it as a monitor, run it on an Apify schedule (daily or weekly). The Actor itself doesn't send alerts; connect an Apify integration or webhook to the scheduled run if you want notifications.
What does it return?
One row per host:
| Field | Example |
|---|---|
certStatus | ok, expiring-soon, expired, invalid, not-yet-valid |
daysLeft, expiresAt | 24, 2026-11-13T23:59:59Z |
issuer | Let's Encrypt, Google Trust Services, Sectigo Limited... |
hostnameMatch | the certificate covers this hostname |
chainTrusted | the chain verifies against public roots |
tlsVersion | TLSv1.3 |
problems | plain-English list (untrusted chain, wrong hostname) |
Set warnDays (default 30) to decide when a certificate counts as expiring-soon. The run summary (OUTPUT) counts hosts per status and issuer.
Who is it for?
- Ops, SRE and DevOps teams: an outside check of expiry dates across every public hostname, on a schedule.
- MSPs and agencies: check every client site in one run.
- Security and sales teams: find sites with expired or misconfigured certificates.
- Monitoring agents and schedulers: call it through the Apify API or MCP server.
How much does it cost?
$0.001 per host ($1 per 1,000 hosts). No subscription. Duplicates, invalid input, and non-existent or unreachable hosts are free. Set a maximum total charge per run and the Actor stops cleanly at your budget. On Apify's free plan, the $5 monthly usage credit covers up to about 5,000 hosts a month (less if you use other Apify Actors or services).
How does it work?
One TLS handshake per host on port 443. The handshake uses SNI with the exact hostname you give, so you get the certificate a browser would see for that name. It reads the certificate, then closes the connection. No HTTP request is sent and no page is downloaded. Hosts are checked exactly as given, so www.example.com and example.com are separate checks. It collects no personal data.
Use it only on domains you own or are authorized to assess, or for research on public DNS and TLS data. Results come only from public DNS and TLS data; no personal data is collected.
FAQ
How do I check SSL certificate expiration for many domains at once?
Paste the hostnames (or a CSV column) into the input and run it. Each host gets one TLS handshake on port 443, and you can export daysLeft and expiresAt as CSV, Excel or JSON.
How do I monitor SSL certificate expiration automatically?
Save the input as an Apify task and add an Apify schedule (daily or weekly). Filter the results for certStatus = expiring-soon or expired, and connect an Apify integration or webhook to the run if you want an alert. Set warnDays to your alert window, for example 14.
Why check the live certificate when certbot renews automatically? A renewal can succeed on disk while the server keeps serving the old certificate because it was never reloaded. This Actor checks what clients actually see on the live endpoint, using SNI with the exact hostname.
Are SSL certificates going to 47 days? Yes. CA/Browser Forum ballot SC-081 cuts the maximum validity of public TLS certificates in steps, from 398 days to 200 days (from March 15, 2026), then 100 days (from March 15, 2027), then 47 days (from March 15, 2029) (CA/B Forum). Shorter lifetimes mean more renewals that can fail.
Is this like an openssl s_client expiry check? Yes. It runs the same kind of handshake-and-read check at list scale, and adds the hostname-match, chain-trust and TLS-version results. It sends no HTTP request and downloads no page.
Does it check www and non-www separately?
Yes. Hosts are checked exactly as you give them, so add www.example.com, mail.example.com and example.com as separate entries. It only connects on port 443.
Use it from an AI agent or API
Call the Actor through the Apify API (run-sync-get-dataset-items) or Apify's MCP server (https://mcp.apify.com?tools=lentic_labs/ssl-certificate-expiry-checker), with JSON input {"domains": ["example.com"]}. Agents without an Apify account can use Apify's agentic payments (experimental): buy a prepaid token with x402, or pay per request with Skyfire.
Related Lentic Labs Actors
- Email security for the same domains (DMARC, SPF, DKIM, MTA-STS, plus website cert and HSTS): DMARC Checker Bulk - SPF, DKIM & Email Security
- Gmail/Yahoo bulk-sender pass/fail: DMARC & SPF Checker - Google/Yahoo Bulk Sender Compliance
- Email provider for each domain: Email Provider Lookup - Bulk MX for Microsoft 365 & Google
