Domain & SSL Expiry Monitor – certificates, RDAP & change alerts

Domain & SSL Expiry Monitor checks a list of domains for SSL/TLS certificate expiry and domain registration expiry, flags anything expiring soon or broken, and detects changes since the previous run (certificate replaced, issuer, registrar or nameservers changed). Schedule it weekly and never get caught by an expired certificate or a lapsed domain again.

• 🔒 SSL: direct TLS handshake – expiry date, days left, issuer, subject, SANs, TLS version, trusted / untrusted (self-signed, expired, hostname mismatch)
• 🌐 Domain: official RDAP (the successor of WHOIS) via the IANA bootstrap – expiry, registrar, created/updated dates, status, nameservers. Works for .com/.net/.org, most new gTLDs and many ccTLDs such as .uk
• 🚦 Status per host: ok, warning (≤ 30 days), critical (≤ 7 days or untrusted/unreachable), expired
• 🔁 Change detection with a named key-value store; only alerts mode for quiet scheduled runs
• No login, no API keys, no browser

Input

Field	Description
domains	Domains, hostnames or URLs. Empty = demo list.
checkSsl / checkDomain	Turn either check off (default both on).
warnDays / criticalDays	Thresholds in days (default 30 / 7).
onlyAlerts	Output only hosts that are not ok or have changes (default off).
port	TLS port (default 443).
stateStoreName	Named key-value store for change detection.

{
  "domains": ["example.com", "shop.example.co.uk", "api.example.io"],
  "warnDays": 21,
  "onlyAlerts": true
}

Output

{
  "input": "apify.com",
  "host": "apify.com",
  "registrableDomain": "apify.com",
  "status": "ok",
  "alerts": [],
  "changes": [],
  "sslDaysLeft": 75,
  "sslValidTo": "2027-01-16T23:59:59.000Z",
  "sslValidFrom": "2025-12-18T00:00:00.000Z",
  "sslValid": true,
  "sslIssuer": "Amazon",
  "sslSubject": "apify.com",
  "sslAltNames": ["apify.com", "*.apify.com"],
  "tlsProtocol": "TLSv1.3",
  "sslFingerprint256": "AB:CD:…",
  "sslError": null,
  "domainDaysLeft": 3133,
  "domainExpires": "2035-06-07T…Z",
  "domainCreated": "…",
  "domainUpdated": "…",
  "domainRegistrar": "Amazon Registrar, Inc.",
  "domainStatus": ["client transfer prohibited"],
  "nameservers": ["ns-….awsdns-….com"],
  "domainError": null,
  "rdapUrl": "https://rdap.verisign.com/com/v1/domain/apify.com",
  "checkedAt": "2026-11-02T17:45:00.000Z"
}

A RUN_SUMMARY record has counts per status.

Use cases

• Agencies & MSPs – one scheduled check for all client domains and certificates
• DevOps / SRE – catch failed auto-renewals (Let's Encrypt, ACM) before users see warnings
• Domain portfolio owners – registration expiry and registrar / nameserver change alerts (possible hijack or transfer)
• Security & vendor due diligence – certificate issuers and validity across third-party domains
• Send alerts to Slack, email or webhooks with Apify integrations

Limitations

• Some registries publish no RDAP (e.g. .de, .es, several ccTLDs) – their domain expiry is reported as unknown; SSL checks still work.
• Some registries return limited data or rate-limit RDAP; failures are reported in domainError rather than failing the run.
• The SSL check reads the certificate the server presents to SNI on the given port; it does not perform a full TLS configuration audit.

Legal note

The Actor uses only public information: the certificate every HTTPS server presents to any visitor and the registries' public RDAP services. It does not log in or probe for vulnerabilities. RDAP responses may contain registrant contact data for some domains; the Actor outputs only registrar, dates, status and nameservers, not personal contact details. Use the results in line with applicable law and registry terms.