SSL Certificate & Security Header Audit

Know before your certificate expires — and see which security headers are missing — across every domain you own, in one scheduled run.

Reads the certificate straight from a TLS handshake, so it reports what a browser would actually see: issuer, validity window, hostname coverage, chain trust and negotiated TLS version. Then it checks the six headers that materially change a site's security posture, and grades the result A to F.

What you get

{
  "domain": "github.com",
  "grade": "A",
  "score": 96,
  "isExpired": false,
  "daysUntilExpiry": 40,
  "validTo": "2026-09-30T23:59:59.000Z",
  "issuer": "Sectigo Limited",
  "isValidForHost": true,
  "trustedByNode": true,
  "tlsProtocol": "TLSv1.3",
  "cipher": "TLS_AES_128_GCM_SHA256",
  "missingSecurityHeaders": ["Permissions-Policy"],
  "issues": ["Missing security headers: Permissions-Policy."]
}

An expired certificate is reported, not skipped — expired.badssl.com returns grade F with isExpired: true, daysUntilExpiry: -4149 and the untrusted-chain reason.

Main use cases

• Certificate expiry monitoring. Schedule weekly and alert on daysUntilExpiry < 30. An expired cert takes a site down.
• Portfolio audits across every domain and subdomain you own.
• Vendor and acquisition due diligence.
• Compliance evidence — HSTS, CSP, X-Frame-Options coverage as a CSV.
• Post-deploy verification that a renewal actually rolled out.

What is graded

Check	Weight
Certificate valid and not expiring within 30 days	35
Certificate covers the hostname (wildcard-aware)	15
Chain trusted by a real trust store	15
Modern TLS (1.2 / 1.3)	10
Security headers present	up to 25

Wildcard matching follows browser rules: *.example.com covers a.example.com but not a.b.example.com.

Pricing

Event	Price	When
Domain audited	$0.003	One domain with a completed handshake and header check

Domains where the TLS handshake failed entirely are not charged — there is nothing useful to return.

1,000 domains = $3.00.

Input

Field	Type	Default	Notes
domains	array	required	Ports and paths stripped automatically. Up to 5,000.
concurrency	integer	8	Parallel handshakes.

Limitations

• Port 443 only. Mail and other TLS services on different ports are not checked.
• Configuration, not a penetration test. It reads the certificate and headers; it does not test cipher downgrade, vulnerability classes, or header values beyond presence.
• Header checks need a working certificate. If TLS fails, headers cannot be read — reported in issues rather than silently omitted.
• Grades are this Actor's own scoring model, not an industry standard such as SSL Labs.

Related Actors

• Bulk Email Deliverability Auditor — SPF, DKIM and DMARC for the same domains.
• Bulk URL Status & Redirect Chain Checker — HTTP-level health for the same list.

Reliability

• Retries on 429 and 5xx with exponential backoff; permanent 4xx errors are not retried.
• Bad input is reported and skipped, never charged.
• One failing target never aborts the rest of the run.
• Concurrency is bounded and configurable — this work is network-bound, so parallel requests, not memory, are what control speed.

Data source and responsible use

Reads only publicly available data. No authentication bypass, no CAPTCHA circumvention, no browser automation.

Not affiliated with any of the services checked.

How to use SSL Certificate & Security Header Audit

1. Open SSL Certificate & Security Header Audit on Apify Store and click Try for free.
2. Fill in the input (the form is prefilled with a working example) and click Start.
3. Watch results appear in the Output tab, then download them as JSON, CSV, Excel or HTML, or read them through the API.
4. Optional: save the input as a task and add a schedule to run it automatically, or connect it to your tools with integrations and webhooks.

Output example

Each result is one dataset item. A real item from a test run (long fields shortened):

{
  "domain": "github.com",
  "grade": "A",
  "score": 96,
  "isExpired": false,
  "daysUntilExpiry": 40,
  "validTo": "2026-11-29T23:59:59.000Z",
  "issuer": "Sectigo Limited",
  "subject": "github.com",
  "isValidForHost": true,
  "trustedByNode": true,
  "tlsProtocol": "TLSv1.3",
  "cipher": "TLS_AES_128_GCM_SHA256"
}

Use SSL Certificate & Security Header Audit with AI agents (MCP)

Give Claude, ChatGPT, Cursor, VS Code or any MCP client this Actor as a tool through the hosted Apify MCP server. The agent sees the input fields with descriptions and example values, runs the Actor, and reads the results.

MCP server URL (this Actor only):

https://mcp.apify.com/?tools=technicaldost/ssl-certificate-security-audit

Claude Code:

$claude mcp add --transport http apify "https://mcp.apify.com/?tools=technicaldost/ssl-certificate-security-audit" --header "Authorization: Bearer YOUR_APIFY_TOKEN"

Cursor, VS Code, Claude Desktop and other clients (mcp.json or the client's MCP settings):

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=technicaldost/ssl-certificate-security-audit",
      "headers": { "Authorization": "Bearer YOUR_APIFY_TOKEN" }
    }
  }
}

Clients that support sign-in (such as Claude.ai connectors) can use the URL without a token and log in to Apify instead. Get your token in Apify Console → Settings → API & Integrations, or generate a ready config for your client at mcp.apify.com. In the agent the tool is named technicaldost--ssl-certificate-security-audit; ask it, for example, to "run SSL Certificate & Security Header Audit with {"domains": ["github.com", "expired.badssl.com"]}".

AI agents without an Apify account can also run and pay for this Actor per request with x402 agentic payments.

Run SSL Certificate & Security Header Audit via API

Run the Actor and get its results in one call (replace YOUR_APIFY_TOKEN):

curl -X POST "https://api.apify.com/v2/acts/technicaldost~ssl-certificate-security-audit/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["github.com", "expired.badssl.com"]}'

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("technicaldost/ssl-certificate-security-audit").call(run_input={"domains": ["github.com", "expired.badssl.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / TypeScript (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('technicaldost/ssl-certificate-security-audit').call({"domains": ["github.com", "expired.badssl.com"]});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Long runs: start them with POST /v2/acts/technicaldost~ssl-certificate-security-audit/runs and fetch the dataset when the run finishes, or receive a webhook.

Integrations

SSL Certificate & Security Header Audit works with Make, Zapier, n8n, LangChain, Google Sheets, Slack, GitHub and webhooks. Schedule runs in Apify Console and send new results straight to your apps, spreadsheets or AI pipelines.

FAQ

Can I use SSL Certificate & Security Header Audit with AI agents like Claude or ChatGPT?

Yes. Connect the Apify MCP server with ?tools=technicaldost/ssl-certificate-security-audit (see above) and the agent can run the Actor and read its results on its own.

Can I call SSL Certificate & Security Header Audit from my own code?

Yes. Use the REST API, or the official Python and JavaScript clients shown above. Results are available as JSON, CSV, Excel, XML or HTML.

How do I run it on a schedule?

Save your input as a task in Apify Console and add a schedule (for example, daily). Use webhooks or integrations to send each run's results onward.

Is it legal to use this Actor?

It works with publicly available data. Make sure your use complies with the source website's terms and with data protection laws such as GDPR, especially for personal data.

Something doesn't work or I need a feature. What should I do?

Open an issue in the Issues tab on this Actor's page with an example input, and we'll look into it.