Bulk SSL Certificate Expiry Checker & Monitor

Check SSL/TLS certificates for thousands of domains: days to expiry, issuer, SANs, hostname match, trust chain, TLS version and cipher, with no login, no browser and no code. Export to JSON, CSV or Excel, or use the API.

Check SSL/TLS certificates for a list of domains and get the days left before expiry, issuer, SANs, hostname match, trust status, TLS version and cipher for each one. Turn on monitor mode and schedule it daily to catch renewals, CA switches, and new problems before your visitors see a browser warning.

Who uses it

• Agencies and MSPs watching dozens or hundreds of client sites
• IT and security teams auditing subdomains
• SEO teams, since an expired certificate kills traffic

Input

hosts (domains, URLs or host:port), warnDays (default 30), monitorMode, onlyChanged.

Output (one row per host)

status is one of OK, EXPIRING_SOON, EXPIRED, NAME_MISMATCH, UNTRUSTED or UNREACHABLE. Each row also has daysRemaining, validTo, issuer, sans, hostnameMatches, authorized, protocol, cipher, chain and handshakeMs. In monitor mode it adds changed and changes.

Tips

Schedule daily with monitorMode: true, onlyChanged: true, then connect a Slack or email integration to the dataset.

Example output

{
  "host": "apify.com",
  "port": 443,
  "reachable": true,
  "authorized": true,
  "authorizationError": null,
  "hostnameMatches": true,
  "subjectCN": "*.apify.com",
  "issuer": "Amazon",
  "issuerCN": "Amazon RSA 2048 M04",
  "validFrom": "2026-07-03T00:00:00.000Z",
  "validTo": "2027-01-16T23:59:59.000Z",
  "daysRemaining": 96,
  "expired": false,
  "expiringSoon": false,
  "sans": [
    "*.apify.com",
    "apifier.com",
    "*.apifier.com"
  ],
  "sanCount": 4,
  "serialNumber": "033947021329345FC779537CD9A338FD",
  "fingerprint256": "8B:70:D5:07:BC:74:55:22:2A:23:E0:08:36:D1:D8:1B:75:F1:0B:99:99:0F:E5:B8:AE:6E:9A:9C:08:F1:F9:8C"
}

Pricing

Pay per result, with no monthly rental or subscription:

• Host checked: $0.001
• Certificate changed (monitor): $0.005

Example: 1,000 results cost about $1.00 in fees. Apify's free plan includes $5 of monthly credit, which is enough to test this Actor.

FAQ

Do I need an account, cookies or a login for the source site? No. Bulk SSL Certificate Expiry Checker & Monitor uses public data sources only, so there is nothing to connect and no account to risk.

How much will a run cost? You pay only for results delivered (see Pricing above), plus Apify platform usage, which the free plan's monthly credit easily covers for test runs. Start with a small limit to see the exact cost per run.

Can I export to CSV, Excel or Google Sheets? Yes. Every run's dataset can be downloaded as JSON, CSV, Excel, XML or HTML, or pushed to Google Sheets, Make, Zapier, n8n, Slack or a webhook through Apify integrations.

Can I run it on a schedule or from my own code? Yes. Add an Apify Schedule (hourly, daily, weekly) or call it through the Apify API / Python & JavaScript clients. It also works with AI agents through the Apify MCP server.

What happens if an input is invalid or a source is down? The run keeps going. The bad input gets a row with an error field so you can see what failed, and you are not charged for results that were not delivered.

Is this legal to use? It collects publicly available data. You are responsible for using the output in line with the source's terms and privacy laws such as GDPR/CCPA; don't use it for spam.

Something missing or broken? Open an issue on the Issues tab. Feature requests are usually added within a few days.

Related tools

• Bulk HTTP Security Headers Checker & Grade (with change alerts)
• Bulk Domain WHOIS (RDAP) Lookup: Age, Expiry, Registrar & DNS
• Bulk DNS Lookup & DNS Change Monitor
• Subdomain Finder (Certificate Transparency) + Live Check

REST API

GET https://api.mediaprotools.com/v1/ssl-check?items=... (header X-API-Key). Up to 10 items per call, separated by ,. Or POST {"items":[...],"options":{...}}.

Parameter	Type	Notes
items	token	Domains or URLs; host:port is accepted.
port	integer 1-65535	Used when a host has no :port.
warnDays	integer 1-1000000	Certificates expiring within this many days get status EXPIRING_SOON.

Output fields: authorizationError, authorized, chain, checkedAt, cipher, daysRemaining, error, expired, expiringSoon, fingerprint256, handshakeMs, host, hostnameMatches, issuer, issuerCN, keyBits, port, protocol, reachable, sanCount, sans, serialNumber, status, subjectCN, validFrom, validTo.