# 🔒 SSL Certificate Checker — Bulk Expiry Monitor (`nexgendata/ssl-certificate-checker`) Actor Bulk SSL certificate monitoring — expiry dates, issuers, chain validation and TLS config across all your domains. Qualys SSL Labs, Nagios & Datadog alternative for agencies and SecOps teams. Alerts before certs expire. Pay per check. - **URL**: https://apify.com/nexgendata/ssl-certificate-checker.md - **Developed by:** [NexGenData](https://apify.com/nexgendata) (community) - **Categories:** Developer tools, Business - **Stats:** 4 total users, 2 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $10.00 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## 🔒 SSL Certificate Checker — Bulk Expiry Monitor & TLS Config Audit Bulk-check SSL/TLS certificates for any domain at scale: expiry date, issuer, signature algorithm, key size, full certificate chain, SAN list, TLS-version + cipher-suite support, OCSP / CRL status, and HSTS / HTTP→HTTPS redirect detection. A pay-per-result **alternative to** Qualys SSL Labs (rate-limited), DigiCert CertCentral, SSLMate Cert Spotter, and Detectify — designed for security ops monitoring thousands of domains, MSPs running cert-expiry SLAs for clients, and dev teams hunting weak TLS configs in their attack surface. ### Why SSL Certificate Checker Beats Qualys SSL Labs, DigiCert, SSLMate & Detectify | Feature | NexGenData SSL Cert Checker | Qualys SSL Labs | DigiCert CertCentral | SSLMate Cert Spotter | Detectify | |---|---|---|---|---|---| | Cost | $0.5 per 1K domains, pay-per-event | Free (heavy throttle) | $$ — license-bundled | $$ / month | $$$$ enterprise | | Bulk-friendly | Yes — 10k domains/run | No — 1 domain at a time | Yes (licensed) | Yes (paid plan) | Yes | | Full chain + SAN list | Yes | Yes | Yes | Yes | Yes | | TLS version + cipher report | Yes | Yes (detailed) | Yes | Limited | Yes | | OCSP / CRL status | Yes | Yes | Yes | Yes | Yes | | HSTS / HTTPS-redirect check | Yes | Yes | No | No | Yes | | Bulk export | JSON / CSV / Excel | HTML scrape only | CSV | API | CSV | | Auth | Apify token | None (throttled) | Account + license | Account + plan | Account + plan | | Monthly minimum | None | None | License contract | $$ | $$$$ | Most security teams pick this actor **instead of** Qualys SSL Labs because Qualys throttles bulk runs to a trickle — this actor is a **drop-in alternative** that handles 10,000 domains per run, **cheaper than** SSLMate Cert Spotter for monitoring-only use cases, and a viable **replacement** for DigiCert's expiry-check feature when you don't already have a DigiCert contract. ### What You Get Per Domain Each dataset item is a flat record: - `domain`, `resolved_host`, `port` - `valid` — boolean (cert presents + chain validates) - `expires_at`, `days_until_expiry` - `issued_at` - `issuer` — `{name, common_name, organization}` - `subject` — `{common_name, organization, country}` - `san[]` — Subject Alternative Names - `chain[]` — full intermediate + root chain - `signature_algorithm`, `key_algorithm`, `key_size` - `fingerprint_sha1`, `fingerprint_sha256` - `tls_versions_supported[]` — TLS 1.0 / 1.1 / 1.2 / 1.3 - `cipher_suites[]` — full negotiated cipher list - `ocsp_status`, `crl_status` - `hsts` — `{enabled, max_age, include_subdomains, preload}` - `redirects_to_https` — boolean - `is_self_signed`, `is_wildcard`, `is_lets_encrypt` ### Use Cases - **Security ops teams** — monitor 5k+ corporate + acquired domains for cert expiry with weekly cron - **MSPs** — run a daily cert-expiry sweep across every client's domain portfolio and Slack-alert on <14 days - **Penetration testers** — find weak-cipher TLS endpoints in a target's external attack surface - **Compliance auditors** — produce evidence reports for SOC 2 / ISO 27001 control AC-17 (TLS in transit) - **DevOps teams** — flag misissued or non-Let's-Encrypt certs in environments that should be using LE - **CDN / hosting migration** — verify post-migration cert deployment across hundreds of subdomains ### Quick Start ```python from apify_client import ApifyClient client = ApifyClient("YOUR_APIFY_TOKEN") run = client.actor("nexgendata/ssl-certificate-checker").call(run_input={ "domains": ["example.com", "google.com", "github.com"], "checkTLSConfig": True, "checkHSTS": True }) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item["domain"], item["days_until_expiry"], item["issuer"]["name"]) ```` ### Pricing Pay-per-event: - **Actor Start**: small fixed charge per run (memory-scaled) - **Per domain**: $0.5 per 1,000 domains checked No subscription, no minimum. ### Related NexGenData Actors | Use case | Actor | |----------|-------| | DNS records bulk lookup | [dns-records-lookup](https://apify.com/nexgendata/dns-records-lookup?fpr=2ayu9b) | | Whois replacement (free Whois API alt) | [whois-replacement](https://apify.com/nexgendata/whois-replacement?fpr=2ayu9b) | | DNS propagation checker | [dns-propagation-checker](https://apify.com/nexgendata/dns-propagation-checker?fpr=2ayu9b) | | DMARC bulk auditor | [dmarc-bulk-auditor](https://apify.com/nexgendata/dmarc-bulk-auditor?fpr=2ayu9b) | | Email RBL / blocklist checker | [email-rbl-checker](https://apify.com/nexgendata/email-rbl-checker?fpr=2ayu9b) | | IP geolocation replacement | [ip-geolocation-replacement](https://apify.com/nexgendata/ip-geolocation-replacement?fpr=2ayu9b) | | Tranco rank lookup (Alexa alt) | [tranco-rank-lookup](https://apify.com/nexgendata/tranco-rank-lookup?fpr=2ayu9b) | | Wappalyzer replacement (tech stack) | [wappalyzer-replacement](https://apify.com/nexgendata/wappalyzer-replacement?fpr=2ayu9b) | ### FAQ **Does it check certs on non-443 ports?** Yes — pass `port: 8443` (or any) per domain. **Do you support SNI?** Yes — Server Name Indication is sent on every connection. **Can I check internal / non-public hostnames?** No — the actor connects from Apify cloud egress, so the host must be publicly reachable. **Output formats?** JSON, CSV, Excel, and the Apify dataset API. **Is this legal?** Yes. Reading a publicly served TLS handshake is the explicit purpose of TLS — there is no auth bypass involved. ### About NexGenData NexGenData publishes 260+ buyer-intent actors covering SEC filings, YC alumni, lead generation, competitive intelligence, stock fundamentals across 30+ exchanges, and more. All pay-per-result. Browse the full catalog at https://apify.com/nexgendata?fpr=2ayu9b *** ### How NexGenData Pricing Works Every NexGenData actor uses **pay-per-event** pricing — you only pay for results that actually land in your dataset. No monthly minimum, no seat fees, no surprise overage bills. - **Actor Start:** a single-event charge each time you spin the actor up (scaled to memory size) - **Result / item:** charged per item written to the default dataset - **No charge** for retries, internal proxy rotation, or failed sub-requests — those are absorbed by the platform ### Apify Platform Bonus New to Apify? Sign up with the NexGenData [referral link](https://www.apify.com/?fpr=2ayu9b) — you get free platform credits on signup (enough for several thousand free results) and you help fund the maintenance of this actor fleet. ### Integration Surface Every actor in the NexGenData catalog can be triggered from: - **Apify console** — point-and-click run - **Apify API** — REST + webhooks - **Apify Python / JS SDKs** — programmatic batch - **Zapier, Make.com, n8n** — official integrations - **MCP** — many actors are exposed as MCP tools for Claude / ChatGPT / Cursor agents - **Schedules** — built-in cron for daily / weekly / monthly runs - **Webhooks** — POST results to any HTTPS endpoint on dataset write ### Support NexGenData maintains 260+ Apify actors and ships updates regularly. Bug reports via the Apify console issues tab get a response within 24 hours. Roadmap requests are welcome — high-demand features ship in the next version. Home: [thenextgennexus.com](https://thenextgennexus.com) Full catalog: [apify.com/nexgendata](https://apify.com/nexgendata?fpr=2ayu9b) # Actor input Schema ## `domain` (type: `string`): Domain to check SSL certificate for ## `port` (type: `integer`): Port number ## Actor input object example ```json { "domain": "google.com", "port": 443 } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("nexgendata/ssl-certificate-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("nexgendata/ssl-certificate-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call nexgendata/ssl-certificate-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=nexgendata/ssl-certificate-checker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "🔒 SSL Certificate Checker — Bulk Expiry Monitor", "description": "Bulk SSL certificate monitoring — expiry dates, issuers, chain validation and TLS config across all your domains. Qualys SSL Labs, Nagios & Datadog alternative for agencies and SecOps teams. Alerts before certs expire. Pay per check.", "version": "1.0", "x-build-id": "h3AaPoblZJ0EulgUg" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/nexgendata~ssl-certificate-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-nexgendata-ssl-certificate-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/nexgendata~ssl-certificate-checker/runs": { "post": { "operationId": "runs-sync-nexgendata-ssl-certificate-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/nexgendata~ssl-certificate-checker/run-sync": { "post": { "operationId": "run-sync-nexgendata-ssl-certificate-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domain" ], "properties": { "domain": { "title": "Domain", "type": "string", "description": "Domain to check SSL certificate for", "default": "google.com" }, "port": { "title": "Port", "minimum": 1, "maximum": 65535, "type": "integer", "description": "Port number", "default": 443 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```