Domain & SSL Expiry Checker (RDAP + Certificate)

Check domain registration and SSL certificates for many domains in one pass. For each domain you get the registrar, creation and expiry dates, days left, nameservers and DNSSEC from the official RDAP registry data (the modern WHOIS), with a WHOIS fallback for ccTLDs. You also get the live TLS certificate: issuer, validity window, days left, SANs and whether it validates. Anything expiring within your alert window is flagged.

You don't need an API key, a proxy or a browser. Results come back in seconds.

Why this tool

• Two monitors in one row: domain expiry and SSL expiry together, so you don't need two tools and two schedules
• Official data: RDAP servers found automatically from the IANA bootstrap (gTLDs and most ccTLDs), with WHOIS on port 43 when a TLD has no RDAP
• Ready-made alerts: domain-expiring-soon, domain-expired, domain-available, ssl-expiring-soon, ssl-expired, ssl-invalid, ssl-unreachable
• Monitoring mode: with onlyAlerts, a scheduled run writes (and charges for) only the rows that need attention
• Availability sweep: check name ideas across many TLDs (mybrand × com, io, ai, co)

Use cases

• Agencies and IT teams watching client portfolios for expiring domains and certificates
• Domain investors checking availability and expiry dates in bulk
• Security and compliance audits covering invalid, self-signed, mismatched or soon-to-expire certificates
• Brand protection: sweep a brand name across TLDs

Input

{
  "domains": ["apify.com", "github.com", "www.bbc.co.uk"],
  "checkDomain": true,
  "checkSsl": true,
  "warnDays": 30,
  "onlyAlerts": false
}

• domains: bare domains, subdomains or URLs. Registration data uses the registrable domain (www.bbc.co.uk → bbc.co.uk). The certificate is checked on the host as given, which you can change with sslHost.
• namesToCheck + tlds: optional availability sweep
• warnDays: alert window in days
• onlyAlerts: output only rows with an alert
• whoisFallback, perRegistryConcurrency, maxConcurrency, requestTimeoutSecs, maxRetries, maxDomains: advanced settings

Output example

{
  "input": "github.com",
  "domain": "github.com",
  "availability": "registered",
  "registrar": "MarkMonitor Inc.",
  "createdDate": "2007-10-09T18:20:50Z",
  "expiryDate": "2028-10-09T18:20:50Z",
  "daysUntilExpiry": 703,
  "nameservers": ["dns1.p08.nsone.net", "ns-1283.awsdns-32.org"],
  "dnssec": false,
  "lookupSource": "rdap",
  "sslValid": true,
  "sslIssuer": "Sectigo Limited",
  "sslValidTo": "2027-01-27T23:59:59Z",
  "sslDaysLeft": 82,
  "sslSans": ["github.com", "www.github.com"],
  "tlsVersion": "TLSv1.3",
  "alerts": [],
  "hasAlert": false
}

A SUMMARY record holds totals (registered, available, alerts).

Pricing

$1.00 per 1,000 domains checked (pay-per-event, domain-checked), covering both the domain lookup and the SSL check. There's no start fee and no charge for platform usage. With onlyAlerts, you pay only for rows that are written.

Scheduling

Create a schedule, for example daily or weekly, with onlyAlerts: true. Then connect a webhook, Slack, email, Zapier or Make so you only hear about domains and certificates that need action.

Notes

• available means the registry's RDAP server returned "not found". For premium or reserved names, confirm with a registrar before buying.
• Some ccTLDs limit or redact public registration data, so a few fields may be empty for those TLDs.
• Registry servers are queried politely, with a per-registry concurrency limit.

Found a TLD that doesn't parse well? Open an issue and we'll add it.