SSL Certificate Checker - Bulk Expiry & Chain

Check the SSL/TLS certificate of hundreds of websites in one run: valid or not, expiry date and days left, issuer, full chain, hostname match, self-signed, TLS version and cipher. Schedule it daily and never let a certificate expire again.

• Clear verdict. valid is true only when the chain is trusted, the hostname matches and the certificate has not expired. error tells you why it isn't: CERT_HAS_EXPIRED, Hostname does not match the certificate, DEPTH_ZERO_SELF_SIGNED_CERT...
• Expiry monitoring. daysToExpiry and expiresSoon (fewer than 30 days by default) for each host. Run it on a schedule and alert on expiresSoon.
• Any port. mail.example.com:993, api.example.com:8443 or a plain URL all work, not only port 443.
• Fast and cheap. Plain TLS handshakes, no browser: $1 per 1,000 hosts.

What can I use it for?

• Certificate expiry monitoring for all your domains and subdomains, or your clients' sites.
• Security audits: find self-signed, mismatched or old-TLS certificates on a list of hosts.
• Due diligence: see which certificate authorities and key types a set of companies uses.
• AI agents: let an agent check a site's HTTPS health through the Apify MCP server.

Input

{
    "hosts": ["apify.com", "https://shop.example.com", "mail.example.com:993"],
    "expiryWarningDays": 30
}

Output

One row per host. Example from a real run (shortened):

{
    "host": "apify.com",
    "port": 443,
    "valid": true,
    "expiresSoon": false,
    "error": null,
    "protocol": "TLSv1.3",
    "cipher": "TLS_AES_128_GCM_SHA256",
    "subject": "*.apify.com",
    "issuer": "Amazon",
    "issuerCommonName": "Amazon RSA 2048 M04",
    "altNames": ["*.apify.com", "apifier.com", "*.apifier.com"],
    "hostnameMatch": true,
    "selfSigned": false,
    "validFrom": "2026-07-03T00:00:00.000Z",
    "validTo": "2027-01-16T23:59:59.000Z",
    "daysToExpiry": 96,
    "keyType": "rsa",
    "keyBits": 2048,
    "serialNumber": "033947021329345FC779537CD9A338FD",
    "fingerprintSha256": "8B:70:D5:07:BC:74:55:22...",
    "chain": [
        { "subject": "Amazon RSA 2048 M04", "issuer": "Amazon", "validTo": "2030-08-23T22:26:35.000Z" },
        { "subject": "Amazon Root CA 1", "issuer": "Starfield Technologies, Inc.", "validTo": "2037-12-31T01:00:00.000Z" }
    ],
    "checkedAt": "2026-10-12T12:07:51.425Z"
}

Pricing

$0.001 per host checked ($1 per 1,000 hosts), plus Apify's small run-start fee. Hosts that refuse the connection or time out count as checked, because that is the answer you need. Invalid names, unknown domains and internal addresses are free.

Fair use and safety

The Actor only performs a TLS handshake to read the certificate. No HTTP request is sent and no page is downloaded. Private and internal network addresses are refused, including public names that point to them.

Use it from AI agents (MCP)

Add ssl-certificate-checker to the Apify MCP server in your MCP client (Claude, Cursor, VS Code...).

Integrations

Apify API, schedules, webhooks, Make, Zapier, n8n. Export as JSON, CSV, Excel or HTML. Pair it with an Apify monitoring alert to get an e-mail when a certificate is close to expiry.

FAQ

Need registrar expiry, DNS and email security too? Use WHOIS & DNS Domain Lookup.

Something wrong or missing? Open an issue on the Issues tab.