SSL Certificate Monitor API | Expiry + Issuer Changes + Optional Web Risk

Bulk-check SSL/TLS certificates for hundreds of domains. Detect expiring certificates, issuer changes, certificate rotations, and optional Google Web Risk reputation signals — before they cause outages.

Store Quickstart

• Start with store-input.example.json for a reliable dataset run across three known domains.
• If that matches your workflow, switch to store-input.templates.json and pick one of:
• Quickstart (Dataset) for first-run validation
• Portfolio Watch for larger domain sets
• Webhook Alert for operational notifications

The Store example is tuned for a quick first success: port=443, moderate concurrency, and a 90-day warning threshold.

What does this actor do?

Connects directly to each domain via TLS (using Node.js's built-in tls module) and inspects the SSL certificate. No browser needed, no proxies needed, and no API keys required for SSL-only runs.

Key Features

• 🔒 Direct TLS inspection — Connects at the protocol level, not through HTTP
• ⏰ Expiry warnings — Configurable alert threshold (default: 30 days)
• 🔄 Certificate rotation detection — Tracks fingerprint changes between runs
• 🔍 Issuer change alerts — Detect when a certificate's issuer changes (potential security issue)
• 🛡️ Optional Google Web Risk lookup — Commercially usable reputation/threat checks with your own Google Cloud API key
• ❌ Invalid cert detection — Catches expired, self-signed, and misconfigured certificates
• 🪝 Webhook notifications — Slack/Discord/custom webhook support

Use Cases

Who	Why
DevOps teams	Prevent certificate expiry outages across all domains
Security teams	Detect unauthorized certificate changes
MSPs	Monitor client SSL certificates at scale
SEO agencies	Verify client sites have valid HTTPS

Input Example

{
  "domains": ["google.com", "github.com", "expired.badssl.com"],
  "expiryWarningDays": 30,
  "concurrency": 5,
  "delivery": "dataset"
}

Optional Google Web Risk input

Google Safe Browsing is intentionally not used here because it is not commercially usable. If you want optional reputation data, enable Google Web Risk instead:

{
  "domains": ["example.com", "github.com"],
  "expiryWarningDays": 30,
  "delivery": "dataset",
  "enableReputationLookup": true,
  "reputationApiKey": "YOUR_GOOGLE_WEB_RISK_API_KEY",
  "reputationThreatTypes": ["MALWARE", "SOCIAL_ENGINEERING"]
}

If enableReputationLookup is false (default), the actor behaves like the original SSL-only version.

Output Example

{
  "domain": "google.com",
  "status": "initial",
  "cert": {
    "subject": "CN=*.google.com, O=Google LLC, C=US",
    "issuer": "CN=WR2, O=Google Trust Services, C=US",
    "validFrom": "Jan 27 08:36:26 2026 GMT",
    "validTo": "Apr 21 08:36:25 2026 GMT",
    "serialNumber": "1A2B3C4D...",
    "bits": 256,
    "altNames": ["*.google.com", "google.com"],
    "authorized": true,
    "protocol": "TLSv1.3"
  },
  "changes": [],
  "warnings": [
    {
      "type": "expiring_soon",
      "message": "Certificate expires in 28 days",
      "daysLeft": 28
    }
  ],
  "reputation": {
    "provider": "google_webrisk",
    "status": "clean",
    "uri": "https://google.com/",
    "checkedAt": "2026-02-22T05:00:54.606Z",
    "requestedThreatTypes": ["MALWARE", "SOCIAL_ENGINEERING"],
    "threatTypes": [],
    "hasThreats": false,
    "expireTime": null
  }
}

A fuller ready-to-share payload is available in sample-output.example.json for Store and README proof.

If Google Web Risk flags a URI, the result also includes a reputation_threat_detected warning and reputation.status = "threat_found".

Cost

Core SSL mode: zero external costs. Uses Node.js built-in TLS — no API keys, no proxies.

Optional reputation mode: Google Web Risk uses your Google Cloud billing account and API key. That optional lookup is commercially usable and is only called when explicitly enabled.

Rate Limiting

• Configurable concurrency (1-10 parallel connections)
• 10-second connection timeout per domain
• Automatic retry on transient network errors

Commercial Ops

Set up .env first:

$cp -n .env.example .env

Cloud Task/Schedule setup (idempotent):

$npm run apify:cloud:setup

Daily reliability checks:

npm run canary:check
npm run contract:test:live

OpenClaw cron commands:

• openclaw-cron-commands.md

Related actors

• rdap-domain-monitor — pair certificate alerts with registrar and ownership changes.
• dns-dmarc-security-checker — extend domain monitoring into email and DNS security.
• security-headers-checker — cover browser-facing security posture on the same sites.