SSL Certificate Expiry & Security Monitor

Bulk-check SSL/TLS certificates for hundreds of domains. Detect expiring certificates, issuer changes, and certificate rotations — before they cause outages.

What does this actor do?

Connects directly to each domain via TLS (using Node.js's built-in tls module) and inspects the SSL certificate. No browser needed, no API keys required, no proxies needed.

Key Features

• 🔒 Direct TLS inspection — Connects at the protocol level, not through HTTP
• ⏰ Expiry warnings — Configurable alert threshold (default: 30 days)
• 🔄 Certificate rotation detection — Tracks fingerprint changes between runs
• 🔍 Issuer change alerts — Detect when a certificate's issuer changes (potential security issue)
• ❌ Invalid cert detection — Catches expired, self-signed, and misconfigured certificates
• 🪝 Webhook notifications — Slack/Discord/custom webhook support

Use Cases

Who	Why
DevOps teams	Prevent certificate expiry outages across all domains
Security teams	Detect unauthorized certificate changes
MSPs	Monitor client SSL certificates at scale
SEO agencies	Verify client sites have valid HTTPS

Input Example

{
  "domains": ["google.com", "github.com", "expired.badssl.com"],
  "expiryWarningDays": 30,
  "concurrency": 5,
  "delivery": "dataset"
}

Output Example

{
  "domain": "google.com",
  "status": "initial",
  "cert": {
    "subject": "CN=*.google.com, O=Google LLC, C=US",
    "issuer": "CN=WR2, O=Google Trust Services, C=US",
    "validFrom": "Jan 27 08:36:26 2026 GMT",
    "validTo": "Apr 21 08:36:25 2026 GMT",
    "serialNumber": "1A2B3C4D...",
    "bits": 256,
    "altNames": ["*.google.com", "google.com"],
    "authorized": true,
    "protocol": "TLSv1.3"
  },
  "changes": [],
  "warnings": [
    {
      "type": "expiring_soon",
      "message": "Certificate expires in 28 days",
      "daysLeft": 28
    }
  ]
}

Cost

Zero external costs. Uses Node.js built-in TLS — no API keys, no proxies. A run checking 200 domains takes ~20 seconds.

Rate Limiting

• Configurable concurrency (1-10 parallel connections)
• 10-second connection timeout per domain
• Automatic retry on transient network errors

Commercial Ops

Set up .env first:

$cp -n .env.example .env

Cloud Task/Schedule setup (idempotent):

$npm run apify:cloud:setup

Daily reliability checks:

npm run canary:check
npm run contract:test:live

OpenClaw cron commands:

• openclaw-cron-commands.md