TLS Certificate Expiry Checker | HTTPS Renewal Audit

TLS Certificate Expiry Checker | HTTPS Renewal Audit

Check verified HTTPS certificates for supplied hosts and export expiry dates, days remaining, issuer, subject, SHA-256 fingerprint and negotiated TLS version. Flag certificates within your renewal window for scheduled domain maintenance.

How it works

Provide HTTPS URLs for domains you maintain. The Actor connects to each supplied origin on port 443, requests its root with HEAD, validates the certificate using Node normal trust and hostname checks, and returns the leaf certificate metadata. Set warningDays between 1 and 365; the default is 30. Run it on a schedule and route expiryWarning=true records into your own maintenance workflow. Paths are ignored and redirects are not followed, so the reported certificate belongs to the requested host rather than a redirect destination.

Quick start

1. Enter one or more public URLs in the Input tab, beginning with the supplied example.
2. Set a maximum run charge. A completed check costs $0.005; checking 10 sources once costs $0.05.
3. Start the Actor and inspect the dataset. Download JSON, CSV or Excel, or consume results through the Apify API.
4. Inspect the OUTPUT run summary as well as the dataset: failed or unprocessed inputs appear there. Save the input as a task if you want to schedule future runs.

Pricing

$0.005 per completed check ($5 per 1,000), with platform usage included. There are no separate Actor-start or dataset-item fees. Empty and unchanged successful checks are charged. The maximum charge is checked before each source request and again before output. Failed network or format checks are free; see the specific HTTP-response cases below. Billing is per completed source check, not per nested array item, extracted URL, change or schema block.

Limits and interpretation

Only certificates that pass normal TLS validation and return an HTTP response produce charged records. Expired, untrusted, hostname-mismatched certificates and handshake/network failures are free errors in OUTPUT, and must also be handled by your monitoring workflow. This cannot inspect the dates of an already-invalid certificate. It reports one observed edge certificate, not every address or certificate chain, revocation status, a cipher-suite scan or a guarantee of future availability. A completed certificate check is charged regardless of the HTTP status returned after the valid handshake.

A run accepts 1-50 unique input URLs and requests them sequentially. Each check has an 18-second network deadline; new checks stop after 160 seconds. Use a 240-second run timeout and 512 MB memory. If the time or charge limit stops a batch, OUTPUT lists uncheckedUrls for a later run. No response exceeding the configured byte limit is accepted, and a complete record must fit within 6 MB. The Actor permits only public HTTP(S) destinations on standard ports, pins a validated DNS address per request, and refuses redirects into private networks or from HTTPS to HTTP.

The Actor uses direct HTTP requests, without a browser, residential proxy, login, CAPTCHA solving or access-control bypass. Rate limits and blocks may prevent checks. Avoid secret-bearing URLs. Results describe the source and network observed at check time.

Integrations and support

Connect the dataset and OUTPUT summary to your own n8n, Make, Zapier or API workflow. This Actor produces data; it does not automatically send email, Slack messages or webhooks to third parties. No external account credentials are needed for the supplied public examples. Report reproducible issues in the Actor Issues tab, including a non-sensitive input and run link. This is an independent utility and is not endorsed by the websites, standards bodies or services it reads.

Input example

{
  "urls": [
    "https://example.com/"
  ],
  "warningDays": 30
}

See the Input tab for all supported fields. Results are available through the dataset API and can be downloaded as JSON, CSV or Excel.

Output fields

Field	Meaning
inputUrl	Normalized supplied URL.
checkedAt	Check time in ISO format.
hostname	Supplied HTTPS hostname.
checkedUrl	Origin root used for the HEAD request; redirects are not followed.
httpStatus	Observed response status.
subject	Certificate subject.
issuer	Certificate issuer.
validFrom	Not-before date in ISO format.
validTo	Not-after date in ISO format.
fingerprint256	SHA-256 leaf certificate fingerprint.
subjectAltName	Certificate alternative names.
protocol	Negotiated TLS protocol.
verified	True: normal Node trust and hostname validation succeeded.
daysRemaining	Whole days remaining, rounded down.
warningDays	Configured renewal warning threshold.
expiryWarning	True when daysRemaining is at or below warningDays.

Output example

Example from a public source check; live values vary. Long items, changes, groups and blocks arrays are shortened to two entries here for readability; the actual record contains the complete arrays within the documented limits.

{
  "inputUrl": "https://example.com/",
  "checkedAt": "2026-09-07T21:05:12.949Z",
  "hostname": "example.com",
  "checkedUrl": "https://example.com/",
  "httpStatus": 200,
  "subject": {
    "CN": "example.com"
  },
  "issuer": {
    "C": "US",
    "O": "SSL Corporation",
    "CN": "Cloudflare TLS Issuing ECC CA 3"
  },
  "validFrom": "2026-07-29T22:10:08.000Z",
  "validTo": "2026-10-27T22:17:21.000Z",
  "fingerprint256": "61:53:A9:6F:D1:A6:AB:7F:4D:43:8F:C3:49:32:48:42:99:D0:72:9D:91:40:B3:A1:26:BB:2F:9C:07:B0:22:00",
  "subjectAltName": "DNS:example.com, DNS:*.example.com",
  "protocol": "TLSv1.3",
  "verified": true,
  "daysRemaining": 50,
  "warningDays": 30,
  "expiryWarning": false
}