SSL Certificate Monitor API | Expiry, Issuer & TLS Coverage

What you get: one row per domain with the certificate's issuer, validity dates, days left, protocol, SANs and fingerprint, plus a severity (critical / high / watch / info) and a one-line brief of what needs attention.

Sample output from a real run (2026-10-18, default input, 3 rows):

domain	severity	issuer	validTo	protocol	brief
expired.badssl.com	critical	COMODO CA Limited	Apr 12 2015	TLSv1.2	2 alert(s): Certificate expired 4207 days ago
github.com	info	Sectigo Limited	Nov 29 2026	TLSv1.3	Certificate looks healthy
google.com	info	Google Trust Services	Dec 21 2026	TLSv1.3	Certificate looks healthy

That run was 3 result rows × $0.009 = $0.027 (there is no separate start fee). Later runs with the same snapshotKey only write rows for certificates that changed or need attention, so a stable portfolio costs $0.

Open Input (leave defaults → Start) Paid first run ≈ USD 0.009/row (1 domain). Keep reports, exports, and movement options off for the first run. Open Console Input (deep link above) and run this JSON.

{
  "domains": [
    "example.com"
  ],
  "port": 443,
  "expiryWarningDays": 90,
  "concurrency": 1,
  "delivery": "dataset",
  "snapshotKey": "ssl-wave-l",
  "dryRun": false
}

Paste domain and Start.

Maintain robust security posture across your infrastructure by using this tool to continuously monitor SSL/TLS certificates for expiration and configuration drift. When you need to extract security details from thousands of websites, relying on manual checks or heavy web browser rendering is inefficient. By validating connections directly at the protocol level, this SSL monitor delivers lightning-fast scraped results, making it the ideal solution for DevSecOps teams handling massive URL lists.

Run scheduled audits to proactively detect expiring certificates before browsers block access to your web pages or search engines penalize your organic results. You can scrape critical data points to extract issuer organization names, pinpoint self-signed certs, and verify active protocol versions across your entire domain portfolio. Beyond standard TLS validation, you can enable optional Google Web Risk checks using your API key to identify websites flagged for malware, phishing, or social engineering.

Every time you execute the scraper, it extracts highly structured results, including precise expiry timestamps, SHA-256 fingerprint hashes, and full certificate chain coverage. Export the scraped details or integrate them with your email and incident management tools to ensure immediate alerts when any website security status changes.

Store Quickstart

• Start with store-input.example.json for a reliable dataset run across three known domains.
• If that matches your workflow, switch to store-input.templates.json and pick one of:
• Quickstart (Dataset) for first-run validation
• Portfolio Watch for larger domain sets
• Webhook Alert for operational notifications

Use with Apify MCP

Exact actor: taroyamada/ssl-certificate-monitor

Sample input JSON:

{
  "domains": [
    "google.com"
  ],
  "port": 443,
  "expiryWarningDays": 90,
  "concurrency": 3,
  "delivery": "dataset",
  "snapshotKey": "ssl-certificate-snapshots"
}

Key Features

• 🔒 Direct TLS inspection — Connects at the protocol level, not through HTTP
• ⏰ Expiry warnings — Configurable alert threshold (default: 30 days)
• 🔄 Certificate rotation detection — Tracks fingerprint changes between runs
• 🔍 Issuer change alerts — Detect when a certificate's issuer changes (potential security issue)
• 🛡️ Optional Google Web Risk lookup — Commercially usable reputation/threat checks with your own Google Cloud API key
• ❌ Invalid cert detection — Catches expired, self-signed, and misconfigured certificates

Use Cases

Who	Why
DevOps teams	Prevent certificate expiry outages across all domains
Security teams	Detect unauthorized certificate changes
MSPs	Monitor client SSL certificates at scale
SEO agencies	Verify client sites have valid HTTPS

Input

Field	Type	Default	Description
domains	array	prefilled	List of domains to check SSL certificates for (e.g. ['example.com', 'github.com']). Maximum 200 per run.
port	integer	443	Port to connect on (default 443).
expiryWarningDays	integer	30	Alert when certificate expires within this many days.
delivery	string	"dataset"	How to deliver results. 'dataset' saves to Apify Dataset (recommended), 'webhook' sends to a URL.
webhookUrl	string	—	Required when delivery is 'webhook'.
snapshotKey	string	"ssl-cert-snapshots"	Key name for storing snapshots (used for change detection between runs).
concurrency	integer	5	Maximum number of parallel requests. Higher = faster but may trigger rate limits.
dryRun	boolean	false	If true, runs without saving results or sending webhooks. Useful for testing.

Input Example

{
  "domains": ["google.com", "github.com", "expired.badssl.com"],
  "expiryWarningDays": 30,
  "concurrency": 5,
  "delivery": "dataset"
}

Input Examples

Example: Single host SSL audit

{
  "domains": [
    "example.com"
  ],
  "port": 443
}

Example: Bulk monitoring with expiry alerts

{
  "domains": [
    "google.com",
    "github.com",
    "example.com"
  ],
  "expiryWarningDays": 90,
  "emitUnchanged": false
}

Example: Recurring watch with its own snapshot

{
  "domains": [
    "github.com",
    "gitlab.com"
  ],
  "snapshotKey": "my-ssl-portfolio",
  "enableReputationLookup": false
}

Output

The first run with a new snapshotKey writes one row per domain. Later runs with the same snapshotKey write only certificates that are new, changed, or need attention; stable checks produce 0 dataset rows and 0 result charges (the run summary is still in the free OUTPUT record). Set emitUnchanged=true when you want a row for every certificate on every run.

Field	Type	Description
domain	string	Domain checked
status	string	initial, changed, ok or error
cert	object	subject, issuer, issuerOrg, validFrom, validTo, serialNumber, fingerprint, bits, altNames, authorized, protocol
changes	object[]	What changed since the last run
warnings	object[]	expired, expiring_soon, auth_error, … with daysLeft
severity	string	critical, high, watch or info
alertCount	integer	Number of warnings
brief	string	One-line summary
reputation	object or null	Google Web Risk result when enableReputationLookup is on
checkedAt	timestamp	When the check ran

Output Example

Row from a real run on example.com with expiryWarningDays: 90 (2026-10-18):

{
  "domain": "example.com",
  "status": "initial",
  "cert": {
    "subject": "CN=example.com",
    "subjectCN": "example.com",
    "issuer": "CN=Cloudflare TLS Issuing ECC CA 3, O=SSL Corporation, C=US",
    "issuerOrg": "SSL Corporation",
    "validFrom": "Sep 26 22:49:11 2026 GMT",
    "validTo": "Dec 25 22:56:35 2026 GMT",
    "bits": 256,
    "altNames": [
      "example.com",
      "*.example.com"
    ],
    "authorized": true,
    "protocol": "TLSv1.3"
  },
  "changes": [],
  "warnings": [
    {
      "type": "expiring_soon",
      "message": "Certificate expires in 68 days",
      "daysLeft": 68
    }
  ],
  "checkedAt": "2026-10-18T11:45:47.376Z",
  "severity": "watch",
  "alertCount": 1,
  "brief": "1 alert(s): Certificate expires in 68 days",
  "error": null,
  "reputation": null
}

API Usage

Run this actor programmatically using the Apify API. Replace YOUR_API_TOKEN with your token from Apify Console → Settings → Integrations.

cURL

curl -X POST "https://api.apify.com/v2/acts/taroyamada~ssl-certificate-monitor/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "domains": ["google.com", "github.com", "expired.badssl.com"], "expiryWarningDays": 30, "concurrency": 5, "delivery": "dataset" }'

Python

from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("taroyamada/ssl-certificate-monitor").call(run_input={
  "domains": ["google.com", "github.com", "expired.badssl.com"],
  "expiryWarningDays": 30,
  "concurrency": 5,
  "delivery": "dataset"
})

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / Node.js

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_API_TOKEN' });
const run = await client.actor('taroyamada/ssl-certificate-monitor').call({
  "domains": ["google.com", "github.com", "expired.badssl.com"],
  "expiryWarningDays": 30,
  "concurrency": 5,
  "delivery": "dataset"
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Security cluster — Adjacent actors

Most defensive-security audits cover multiple layers on the same domains. The actors below pair naturally with this one:

• dns-dmarc-security-checker — Audit email-security DNS records (DMARC / SPF / DKIM / MX) on the same domains.
• security-headers-checker — On the same hosts, audit HTTP security headers as the application-layer complement.
• dns-propagation-checker — Propagation check after certificate renewal — confirm new cert is served from every resolver.

Tips & Limitations

• Schedule weekly runs against your production domains to catch config drift.
• Use webhook delivery to pipe findings into your SIEM (Splunk, Datadog, Elastic).
• For CI integration, block releases on critical severity findings using exit codes.
• Combine with ssl-certificate-monitor for layered cert + headers coverage.
• Findings include links to official remediation docs — share with dev teams via the webhook payload.

FAQ

Is running this against a third-party site legal?

Passive public-header scanning is generally permitted, but follow your own compliance policies. Only scan sites you have authorization for.

How often should I scan?

Weekly for production domains; daily if you have high config-change velocity.

Can I export to a compliance tool?

Use webhook delivery or Dataset API — formats map well to Drata, Vanta, OneTrust import templates.

Is this a penetration test?

No — this actor performs passive compliance scanning only. No exploitation, fuzzing, or auth bypass.

Does this qualify as a SOC2 control?

This actor produces evidence artifacts suitable for SOC2 CC7.1 (continuous monitoring). It is not itself a SOC2 certification.

Related Actors

• Security Headers Checker
• DNS DMARC Security Checker
• DNS Propagation Checker
• Domain Trust Monitor

Cost

Pay Per Event (current Store prices):

• Result row: $0.009 per row written to the default dataset (no separate start fee)

Example: 1,000 rows = 1,000 × $0.009 = $9.00

No subscription required — you only pay for what you use.

⭐ Was this helpful?

If this actor saved you time, please leave a ★ rating on Apify Store. It takes 10 seconds, helps other developers discover it, and keeps updates free.

Bug report or feature request? Open an issue on the Issues tab of this actor.