# SSL Certificate Checker (`ninhothedev/ssl-certificate-checker`) Actor

$1/1K 🔥 Fast SSL certificate checker! Expiry, issuer, SAN & days-left for any host. No key. JSON, CSV, Excel or API in seconds. Paste domains & monitor thousands of certificates for security & uptime ⚡

- **URL**: https://apify.com/ninhothedev/ssl-certificate-checker.md
- **Developed by:** [ninhothedev](https://apify.com/ninhothedev) (community)
- **Categories:** Developer tools, Automation, Integrations
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## SSL Certificate Checker 🔒

**Check SSL/TLS certificates for any list of domains — expiry date, days until expiry, issuer, Subject Alternative Names (SAN), serial number, TLS version and cipher.** No proxy, no browser, no login. Runs on Apify's free datacenter and works from anywhere.

Perfect for **certificate expiry monitoring**, **security audits**, **DevOps automation** and **uptime / SSL health checks**. Feed it a list of hostnames and get one clean JSON row per host.

👉 **[Run SSL Certificate Checker on Apify »](https://apify.com/ninhothedev/ssl-certificate-checker)**

***

### ✨ What it does

For every host you give it, the actor performs a real TLS handshake using Python's standard-library `ssl` + `socket` (the exact same code path a browser or `curl` uses), reads the server certificate and reports:

| Field | Description |
|-------|-------------|
| `host` | Hostname that was checked |
| `port` | Port used (default `443`) |
| `valid` | `true` if the certificate chain **verified** (trusted, in-date, hostname matches) |
| `common_name` | Subject Common Name (CN) |
| `issuer_org` | Issuing Certificate Authority organization (e.g. *Sectigo Limited*, *Google Trust Services*, *DigiCert Inc*) |
| `issuer_cn` | Issuer Common Name |
| `valid_from` | `notBefore` date (ISO-8601 UTC) |
| `valid_to` | `notAfter` / **expiry** date (ISO-8601 UTC) |
| `days_until_expiry` | Days left before the certificate expires (negative if already expired) |
| `is_expired` | `true` if the certificate is past its expiry date |
| `san` | Array of DNS Subject Alternative Names |
| `serial_number` | Certificate serial number |
| `tls_version` | Negotiated protocol (e.g. `TLSv1.3`) |
| `cipher` | Negotiated cipher suite |
| `error` | Verification/handshake error message, if any |
| `scraped_at` | ISO-8601 timestamp of the check |

Even for **expired or self-signed** certificates the actor still reports full details (issuer, expiry, SAN…) — it does a second, verification-disabled handshake so you always see *why* a certificate failed, with `is_expired` set correctly.

### 📥 Input

```json
{
  "hosts": ["github.com", "expired.badssl.com", "google.com"],
  "maxItems": 100
}
```

| Property | Type | Description |
|----------|------|-------------|
| `hosts` | array (required) | Hostnames or URLs. Scheme and path are stripped automatically. Add `:port` for non-standard ports. |
| `maxItems` | integer | Cap on hosts checked per run. Default `100`, max `1000`. |

You can paste bare domains (`example.com`), full URLs (`https://example.com/login`) or `host:port` (`mail.example.com:8443`).

### 📤 Output

One dataset item per host:

```json
{
  "host": "github.com",
  "port": 443,
  "valid": true,
  "common_name": "github.com",
  "issuer_org": "Sectigo Limited",
  "issuer_cn": "Sectigo Public Server Authentication CA DV E36",
  "valid_from": "2026-06-03T00:00:00+00:00",
  "valid_to": "2026-09-30T23:59:59+00:00",
  "days_until_expiry": 89,
  "is_expired": false,
  "san": ["github.com", "www.github.com"],
  "serial_number": "0AF1E2D3C4B5A6...",
  "tls_version": "TLSv1.3",
  "cipher": "TLS_AES_128_GCM_SHA256",
  "error": null,
  "scraped_at": "2026-07-03T12:00:00+00:00"
}
```

Export as **JSON, CSV, Excel, HTML or RSS** from the dataset, or pull it via the Apify API.

### 💡 Use cases

- **Certificate expiry monitoring** — schedule a daily run over your domains and alert when `days_until_expiry` drops below your threshold. Never get surprised by an expired cert again.
- **Security & compliance audits** — verify issuers, minimum TLS version and cipher suites across an estate.
- **DevOps / SRE automation** — wire the JSON into CI, dashboards, Slack or PagerDuty.
- **Uptime & SSL health checks** — combine `valid`, `is_expired` and `error` for a one-glance health signal.
- **Pre-migration checks** — confirm SAN coverage before switching DNS or CDNs.

### 💰 Pricing

Pay-as-you-go, roughly **$1 per 1,000 hosts** checked (input) plus the JSON output — thanks to lightweight stdlib TLS handshakes with no proxy or browser overhead, most runs cost a few cents. Free Apify plan is enough to get started.

### ⚖️ Why this actor

| | SSL Certificate Checker | Manual `openssl s_client` | Browser padlock |
|--|--|--|--|
| Bulk / many domains | ✅ Yes | ❌ One at a time | ❌ |
| Structured JSON/CSV | ✅ | ❌ Raw text | ❌ |
| Days-until-expiry | ✅ Computed | ❌ Manual math | ❌ |
| Reads expired/self-signed | ✅ | ⚠️ Flags/quirky | ⚠️ |
| Schedulable + API | ✅ | ❌ | ❌ |
| No proxy needed | ✅ | ✅ | — |

### 🔗 Related actors by ninhothedev

- [Security Headers Checker](https://apify.com/ninhothedev/security-headers-checker)
- [DNS Records Scraper](https://apify.com/ninhothedev/dns-records-scraper)
- [RDAP Domain Scraper](https://apify.com/ninhothedev/rdap-domain-scraper)
- [Website Tech Stack Detector](https://apify.com/ninhothedev/website-tech-stack-detector)

### 🛟 Support

Questions, feature requests or a domain that behaves oddly? Open an issue on the actor's **Issues** tab and I'll take a look.

***

*Keywords: SSL checker, TLS certificate checker, certificate expiry monitor, SSL expiry, days until expiry, certificate issuer lookup, SAN checker, subjectAltName, TLS version, cipher, HTTPS monitoring, SSL audit, DevOps SSL, cert monitoring, security headers, domain SSL.*

# Actor input Schema

## `hosts` (type: `array`):

List of hostnames or URLs to check. Scheme and path are stripped automatically. Append ':port' for non-standard ports (default 443). Examples: github.com, https://example.com/login, mail.example.com:8443.

## `maxItems` (type: `integer`):

Safety cap on how many hosts from the list are checked in a single run.

## Actor input object example

```json
{
  "hosts": [
    "github.com",
    "expired.badssl.com",
    "google.com"
  ],
  "maxItems": 100
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "hosts": [
        "github.com",
        "expired.badssl.com",
        "google.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("ninhothedev/ssl-certificate-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "hosts": [
        "github.com",
        "expired.badssl.com",
        "google.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("ninhothedev/ssl-certificate-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "hosts": [
    "github.com",
    "expired.badssl.com",
    "google.com"
  ]
}' |
apify call ninhothedev/ssl-certificate-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=ninhothedev/ssl-certificate-checker",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/FHwsRpDaOFTlbkst0/builds/ePcYhYVWuaWcomtCC/openapi.json