SSL Certificate Checker — Check SSL/TLS Certificate Details for Any Domain

Check SSL/TLS certificate details for one or more domains. Retrieve issuer, subject, validity dates, Subject Alternative Names (SANs), cipher suite information, certificate chain analysis, and expiry warnings in a single API call.

---

What does it do?

SSL Certificate Checker connects to one or more target domains over TLS and retrieves the full certificate chain presented during the handshake. For each domain, it extracts and analyses every certificate in the chain — from the leaf certificate down to the root CA — and returns detailed information including issuer and subject identities, validity period (notBefore / notAfter), Subject Alternative Names (SANs), signature algorithm, key strength, and the TLS cipher suite negotiated during the handshake.

The actor provides built-in expiry warnings that flag certificates expiring within configurable thresholds (e.g., 14 days, 30 days, 90 days). Chain analysis identifies missing intermediate certificates, untrusted roots, and other chain completeness issues. Batch mode allows checking multiple domains in a single run, making it ideal for organisations managing dozens or hundreds of TLS endpoints.

---

Who is it for?

This actor is designed for:

• DevOps and SRE teams responsible for managing TLS certificate lifecycle across many services.
• Security engineers auditing certificate hygiene, weak cipher support, and chain validity across the organisation.
• Site reliability engineers monitoring certificate expiry to prevent outages caused by expired certificates.
• Penetration testers evaluating TLS configuration strength as part of security assessments.
• Compliance officers who need periodic evidence of proper TLS configuration for regulatory audits (PCI DSS, HIPAA, GDPR).
• Web hosting and domain administrators managing certificates across multiple client or internal domains.

---

Why use this?

Full chain analysis, not just the leaf. Many certificate checkers stop at the leaf certificate. This actor traverses the entire chain, identifying missing intermediate certificates, outdated root stores, and chain ordering issues that can cause trust failures on older clients.

Expiry warnings you can act on. Set your own warning thresholds and get clear, actionable expiry status for each certificate. Never be caught off guard by an expired certificate taking down a production service.

Cipher suite transparency. See exactly which TLS version and cipher suite was negotiated. Identify services still supporting TLS 1.0 or 1.1, weak ciphers (RC4, 3DES), or outdated key exchange methods.

Batch mode for fleet-wide checks. Submit multiple domains in a single run and receive a consolidated report. Perfect for organisations managing certificates across dozens of subdomains, microservices, or customer-facing endpoints.

SAN enumeration. See every Subject Alternative Name in the certificate at a glance. Catch certificates that include unexpected domains (potential misissuance) or that are missing expected domains (potential trust errors).

---

Input Parameters

Parameter	Type	Required	Default	Description
domains	array	Yes	—	Array of domain names to check (e.g., ["example.com", "api.example.com", "admin.example.com"]). Accepts hostnames and IP addresses.
timeoutSecs	number	No	10	Connection timeout per domain in seconds. Increase for slow-responding or high-latency targets.

---

Example Input

Single domain check:

{
  "domains": ["example.com"],
  "timeoutSecs": 10
}

Batch certificate audit:

{
  "domains": [
    "example.com",
    "api.example.com",
    "admin.example.com",
    "mail.example.com",
    "cdn.example.com"
  ],
  "timeoutSecs": 15
}

---

Output Structure

The actor returns a JSON object with results for each domain. Each domain result contains the leaf certificate details, chain information, and expiry analysis.

Field	Type	Description
domain	string	The domain that was checked
resolvedIp	string	IP address the domain resolved to
connected	boolean	Whether a TLS connection was successfully established
error	string	Error message if connection failed
certificate	object	Leaf certificate details
certificate.subject	object	Subject fields (CN, O, OU, L, ST, C)
certificate.issuer	object	Issuer fields
certificate.serialNumber	string	Certificate serial number
certificate.notBefore	string	Validity start (ISO 8601)
certificate.notAfter	string	Validity end / expiry date (ISO 8601)
certificate.daysRemaining	number	Days until expiry
certificate.expiryStatus	string	"valid", "expiring_soon", "expiring_critical", or "expired"
certificate.signatureAlgorithm	string	Signature algorithm (e.g., sha256WithRSAEncryption)
certificate.keySize	number	Public key size in bits
certificate.sans	array	Subject Alternative Names (DNS names)
certificate.selfSigned	boolean	Whether the certificate is self-signed
certificate.isCA	boolean	Whether the certificate is a CA certificate
tlsVersion	string	Negotiated TLS version (e.g., TLSv1.3, TLSv1.2)
cipherSuite	string	Negotiated cipher suite (e.g., TLS_AES_256_GCM_SHA384)
chain	array	Full certificate chain from leaf to root
chain[].subject	object	Subject of each chain certificate
chain[].issuer	object	Issuer of each chain certificate
chain[].notAfter	string	Expiry date of each chain certificate
chain[].selfSigned	boolean	True for root CA (self-signed)
chainIssues	array	Any issues found with the certificate chain
warnings	array	Security warnings (weak cipher, short key, etc.)

---

Example Output

{
  "results": [
    {
      "domain": "example.com",
      "resolvedIp": "93.184.216.34",
      "connected": true,
      "certificate": {
        "subject": {
          "CN": "www.example.org",
          "O": "Internet Corporation for Assigned Names and Numbers",
          "L": "Los Angeles",
          "ST": "California",
          "C": "US"
        },
        "issuer": {
          "CN": "DigiCert TLS RSA SHA256 2020 CA1",
          "O": "DigiCert Inc",
          "C": "US"
        },
        "serialNumber": "0F:E8:9A:7B:2C:4D:5E:6F:1A:2B:3C:4D:5E:6F:7A:8B",
        "notBefore": "2024-06-01T00:00:00.000Z",
        "notAfter": "2025-06-01T23:59:59.000Z",
        "daysRemaining": 120,
        "expiryStatus": "valid",
        "signatureAlgorithm": "sha256WithRSAEncryption",
        "keySize": 2048,
        "sans": [
          "www.example.org",
          "example.org",
          "example.com",
          "www.example.com"
        ],
        "selfSigned": false,
        "isCA": false
      },
      "tlsVersion": "TLSv1.3",
      "cipherSuite": "TLS_AES_256_GCM_SHA384",
      "chain": [
        {
          "subject": { "CN": "www.example.org" },
          "issuer": { "CN": "DigiCert TLS RSA SHA256 2020 CA1" },
          "notAfter": "2025-06-01T23:59:59.000Z",
          "selfSigned": false
        },
        {
          "subject": { "CN": "DigiCert TLS RSA SHA256 2020 CA1" },
          "issuer": { "CN": "DigiCert Global Root CA" },
          "notAfter": "2030-11-09T23:59:59.000Z",
          "selfSigned": false
        },
        {
          "subject": { "CN": "DigiCert Global Root CA" },
          "issuer": { "CN": "DigiCert Global Root CA" },
          "notAfter": "2031-11-09T23:59:59.000Z",
          "selfSigned": true
        }
      ],
      "chainIssues": [],
      "warnings": []
    }
  ]
}

---

API Usage

cURL

# Check a single domain
curl -X POST "https://api.apify.com/v2/acts/perryay~ssl-certificate-checker/runs" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["example.com"],
    "timeoutSecs": 10
  }'

# Batch check multiple domains
curl -X POST "https://api.apify.com/v2/acts/perryay~ssl-certificate-checker/runs" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["example.com", "api.example.com", "admin.example.com"],
    "timeoutSecs": 15
  }'

Python

import requests
from datetime import datetime

API_TOKEN = "YOUR_API_TOKEN"
ACTOR_ID = "perryay~ssl-certificate-checker"

# Check domains
payload = {
    "domains": ["example.com", "api.example.com", "admin.example.com"],
    "timeoutSecs": 15
}

response = requests.post(
    f"https://api.apify.com/v2/acts/{ACTOR_ID}/runs",
    params={"token": API_TOKEN},
    json=payload
)

results = response.json()

# Generate expiry report
print("Certificate Expiry Report")
print("=" * 60)
for cert_result in results["results"]:
    domain = cert_result["domain"]
    if not cert_result.get("connected"):
        print(f"⛔ {domain} - Connection failed: {cert_result.get('error', 'Unknown error')}")
        continue

    cert = cert_result["certificate"]
    status = cert["expiryStatus"]
    days = cert["daysRemaining"]
    status_icon = "✅" if status == "valid" else "⚠️" if "expiring" in status else "❌"

    print(f"{status_icon} {domain} ({cert['sans'][0]})")
    print(f"   Issuer: {cert['issuer']['CN']}")
    print(f"   Expires: {cert['notAfter'][:10]} ({days} days remaining)")
    print(f"   TLS: {cert_result['tlsVersion']} | Cipher: {cert_result['cipherSuite']}")
    print(f"   Key: {cert['keySize']}-bit {cert['signatureAlgorithm']}")

    for warning in cert_result.get("warnings", []):
        print(f"   ⚠ {warning}")

    for issue in cert_result.get("chainIssues", []):
        print(f"   ⛔ Chain issue: {issue}")
    print()

# Find expiring certificates
print("\n=== Certificates needing attention ===")
for cert_result in results["results"]:
    if not cert_result.get("connected"):
        continue
    cert = cert_result["certificate"]
    if cert["expiryStatus"] != "valid":
        print(f"  {cert_result['domain']} - expires {cert['notAfter'][:10]} ({cert['daysRemaining']} days)")

---

Use Cases

Automated certificate expiry monitoring

Run the actor on a weekly schedule to scan all your production domains. Generate a report of every certificate expiring within 30 days and trigger alerts to the team responsible for renewal. Eliminate certificate-related outages entirely.

TLS configuration audit

Audit your entire domain portfolio for TLS version support. Identify services still running TLS 1.0 or 1.1 that need to be upgraded. Flag weak cipher suites (RC4, 3DES, CBC-mode ciphers) and short key sizes (1024-bit RSA or less). Generate a compliance-ready report for auditors.

Certificate chain validation

Detect chain issues before they cause trust errors in production. Identify missing intermediate certificates that older clients (Android, legacy browsers, embedded systems) may not have cached. Validate that certificate chains are complete and correctly ordered.

Post-incident certificate forensics

When a certificate-related incident occurs (misissuance, unexpected revocation, expiry outage), run the affected domains through this actor to capture the full certificate chain, issuer details, and SANs for forensic analysis.

M&A due diligence

When acquiring a company or integrating a third-party service, batch-check all their public-facing TLS endpoints. Assess their certificate hygiene, identify soon-to-expire certificates that need renewal, and evaluate their overall TLS posture before committing to integration.

Bug bounty target reconnaissance

During bug bounty hunting, check TLS configurations of all identified subdomains. Weak ciphers, outdated TLS versions, or misconfigured certificate chains can reveal attack vectors — including CRIME, BREACH, POODLE, and certificate misissuance vulnerabilities.

---

FAQ

Q: Can I check internal/hostname-only domains (e.g., myapp.internal)?

Yes, as long as the domain is resolvable from the actor's runtime environment. Private IP ranges and internal DNS names hosted in split-horizon DNS are reachable only if the actor's default DNS can resolve them. For fully internal domains, consider running a dedicated instance.

Q: Does the actor validate certificate revocation (CRL/OCSP)?

The actor retrieves and reports certificate chain information but does not perform real-time OCSP or CRL revocation checks by default. The checks focus on chain completeness, validity dates, and cryptographic configuration.

Q: What does "expiring_soon" vs "expiring_critical" mean?

The default thresholds are: certificates expiring within 30 days are marked expiring_soon, and those expiring within 7 days are marked expiring_critical. These thresholds can be adjusted if needed.

Q: Does the actor support STARTTLS for SMTP/IMAP/POP3?

The current implementation checks standard TLS on port 443. For STARTTLS-based protocols (port 25/587 SMTP, 143 IMAP, 110 POP3), additional configuration is needed in a specialised version.

Q: Can the actor check wildcard certificates?

Yes. Wildcard certificates are fully supported — the SAN list will include *.example.com alongside any explicit SANs. The report notes the wildcard coverage.

Q: How are self-signed certificates handled?

Self-signed certificates are detected and marked accordingly. The chain analysis will flag them since they lack a trusted CA path, but the certificate details (subject, validity, key size) are still reported fully.

---

Related Tools

• Port Scanner — Identify hosts with open HTTPS ports (443, 8443) to build your certificate audit target list.
• CVE Vulnerability Lookup — After identifying TLS library versions from banners, check for known TLS-related CVEs.
• CSP Analyzer — After validating TLS, check Content-Security-Policy headers on the same web applications.
• Tech Version CVE Checker — Include TLS library versions in your full technology stack CVE audit.

---

🔗 More from perryay

Explore the full suite of developer tools on the Apify Store:

• JSON Studio — Format, validate, transform, and diff JSON data with 8 operation modes
• QR Craft — Generate high-quality QR codes in PNG or SVG, batch up to 50
• UUID Lab — Generate UUID v4/v7, NanoID, Short ID, and ULID identifiers
• Domain Intel — WHOIS, DNS, and SSL lookup for any domain
• Meta Mate — Extract Open Graph, Twitter Cards, and JSON-LD metadata
• IP Geo — Multi-provider IP geolocation with ISP detection
• URL Health — Check URL accessibility, redirects, and SSL health
• PW Forge — Generate secure passwords with entropy calculation
• TZ Mate — Convert timezones and check DST offsets
• Regex Lab — Test and debug regular expressions online
• Brand Monitor Lite — Track brand mentions across multiple URLs
• Link Quality Analyzer — Detect broken links and audit link quality
• Mock Data Generator — Generate realistic test data for development
• HTML to Markdown — Convert web pages or HTML to clean Markdown
• SSL Cert Inspector — Deep SSL/TLS certificate analysis with scoring

---

SEO Keywords

SSL certificate checker, TLS certificate validation, certificate expiry monitor, SSL audit, TLS security check, certificate chain analysis, SAN checker, cipher suite checker, TLS version check, HTTPS certificate, CA certificate validation, SSL expiry alert, certificate lifecycle management, SSL inspection, TLS configuration audit, public key audit, digital certificate verification