Bulk SSL Certificate Expiry Monitor: Any Port & STARTTLS

Check SSL/TLS certificate expiry for hundreds or thousands of hosts in one run, and get a clear OK / WARN / CRITICAL / EXPIRED / ERROR status for each. It works on any port, not just 443: HTTPS on custom ports, LDAPS (636), IMAPS (993), POP3S (995), RDP (3389), Kubernetes/API endpoints, plus STARTTLS for IMAP (143), POP3 (110), SMTP and FTP.

Every row tells you days left, expiry date, subject and SANs, issuer, chain trust, hostname match, key type and size, signature algorithm, TLS version and cipher, serial number and SHA-256 fingerprint. A SUMMARY record gives counts per status and the soonest expiry.

Why this one

• Any port + STARTTLS. Mail servers, directory servers and admin consoles expire too. Point it at imap://mail.example.com, ldaps://dc1.example.com or 203.0.113.10:8443.
• Check every IP behind a hostname. With checkAllIps, it handshakes with each A/AAAA address, using the same SNI. That finds the single load-balancer node or server still serving last year's certificate.
• Change detection for schedules. Set monitorKey and schedule the actor (daily or weekly). Each row then shows changedSinceLastRun, so you can confirm renewals actually went live.
• Real verdicts, not just dates. It catches expired or missing intermediates, self-signed and unknown-root chains, hostname mismatches, RSA keys under 2048 bits, SHA-1 signatures and TLS 1.0/1.1.
• Private CA support. Paste your internal CA in extraCaPem, or set trustIssues to WARN/Ignore to rate expiry only.
• Alert-friendly. onlyProblems writes only the rows that need attention, sorted worst first. The run's status message reads like "1 expired, 2 critical, 3 warn".

Input

{
  "hosts": [
    "example.com",
    "https://www.example.org/login",
    "api.example.net:8443",
    "imaps://mail.example.com",
    "imap://mail.example.com",
    "ldaps://dc1.example.com",
    "203.0.113.10:636",
    "[2001:db8::10]:443"
  ],
  "warnDays": 30,
  "criticalDays": 7,
  "onlyProblems": false
}

Field	Default	Notes
hosts	required	Domains, host:port, IPv4/IPv6, or URLs (https, ldaps, imaps, pop3s, smtps, ftps, rdp, imap, pop3, smtp, ftp). Paths are ignored, *. wildcards are stripped, IDNs are converted, duplicates are removed. Paste lists separated by lines, commas or spaces; # starts a comment. Up to 10,000 targets.
port	443	Default port for entries without one
warnDays / criticalDays	30 / 7	Expiry thresholds
onlyProblems	false	Output only non-OK or changed rows
trustIssues	CRITICAL	Severity for an untrusted chain or hostname mismatch: CRITICAL, WARN or IGNORE
checkAllIps	false	Check each resolved IP separately
includeIpv6	false	With checkAllIps, also test AAAA addresses
starttls	auto	auto (25/587 SMTP, 143 IMAP, 110 POP3, 21 FTP), none, or force smtp/imap/pop3/ftp
servername	–	SNI override for all targets (for example, to check an origin IP behind a CDN)
timeoutSecs	10	Per host: connect + STARTTLS + handshake
concurrency	10	Parallel handshakes (max 50)
monitorKey	–	Enables change detection; state is kept in your named key-value store ssl-expiry-monitor-state
extraCaPem	–	Extra trusted CA certificates (PEM)

Output

One row per host:port (or per IP with checkAllIps), worst first:

{
  "host": "example.com",
  "port": 443,
  "ip": "203.0.113.10",
  "status": "WARN",
  "daysLeft": 21,
  "validTo": "2026-11-06T23:59:59.000Z",
  "validFrom": "2026-08-08T00:00:00.000Z",
  "subjectCN": "example.com",
  "issuerO": "Let's Encrypt",
  "issuerCN": "R12",
  "sans": ["example.com", "www.example.com"],
  "sanCount": 2,
  "chainTrusted": true,
  "authorizationError": null,
  "hostnameMatch": true,
  "selfSigned": false,
  "protocol": "TLSv1.3",
  "cipher": "TLS_AES_256_GCM_SHA384",
  "keyType": "EC",
  "keyBits": 256,
  "signatureAlgorithm": "sha256WithRSAEncryption",
  "serialNumber": "04A1...",
  "fingerprintSha256": "3F:...:9C",
  "chainLength": 3,
  "chain": [{ "subjectCN": "example.com", "issuerCN": "R12", "validTo": "2026-11-06T23:59:59.000Z", "daysLeft": 21 }],
  "issues": ["expires in 21 day(s) (warn <= 30)"],
  "error": null,
  "changedSinceLastRun": null,
  "checkedAt": "2026-10-16T19:00:00.000Z"
}

Status rules:

• EXPIRED: the end date has passed.
• CRITICAL: expires within criticalDays, isn't valid yet, or (by default) has an untrusted chain or a hostname mismatch.
• WARN: expires within warnDays, uses a weak key or signature, negotiated legacy TLS, or has an intermediate expiring before the leaf.
• ERROR: DNS failure, refused connection, timeout, a port that doesn't speak TLS, or STARTTLS refused. The reason is in error.

The key-value store record SUMMARY holds counts per status, the soonest upcoming expiry, a list of problems, invalid inputs and the number of duplicates removed. Download the dataset as CSV, Excel or JSON, or connect it to email, Slack or webhooks with Apify integrations.

Scheduling it as a monitor

1. Save your host list as a task and set monitorKey (for example, prod-certs) and onlyProblems: true.
2. Add a schedule (weekly works for most teams; daily if you have short-lived certificates).
3. Add a notification or webhook on the run so problems reach your inbox or chat.

Notes and limits

• Outbound port 25 is blocked on Apify's cloud, so MX-on-25 checks time out there. SMTP submission on 587 (STARTTLS) and 465 works, as do IMAP/POP3 (STARTTLS or implicit), LDAPS, HTTPS and custom ports.
• Apify's cloud has no IPv6 egress, so [v6]:port targets fail with "network unreachable". checkAllIps tests IPv4 addresses only unless you turn on includeIpv6.
• Revocation (OCSP/CRL) isn't checked. Trust is evaluated against Node.js's bundled Mozilla root store, plus any CA you add.
• Hosts must be reachable from the public internet. Private/RFC 1918 addresses won't connect from Apify's cloud.
• Only a TLS handshake is made: no HTTP request, no login, no mail sent.

Pricing

Pay per event: $1 per 1,000 endpoints checked ($0.001 per host:port, or per IP with checkAllIps). Invalid or duplicate inputs aren't charged.

Related

• Bulk SPF / DMARC / MX Auditor: email authentication checks for many domains.
• Microsoft 365 Tenant Finder: tenant ID and IdP for company domains.
• Bulk ASN IP Lookup: IP to ASN, org, country and BGP prefix.