# SSL Certificate Checker - Domain TLS Expiry & KYB API (`pink_comic/ssl-certificate-checker`) Actor

Bulk SSL/TLS certificate checker for domain KYB and HTTPS audits: expiry, issuer, SANs, chain validation, TLS version, and cipher evidence. Catch expired or misconfigured certs before outages. Related: whois-domain-lookup, dns-lookup-records, website-tech-stack-scanner.

- **URL**: https://apify.com/pink_comic/ssl-certificate-checker.md
- **Developed by:** [Ava Torres](https://apify.com/pink_comic) (community)
- **Categories:** Developer tools, Business, Agents
- **Features:** Limited permissions
- **Stats:** 6 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.08 / 1,000 ssl checks

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SSL Certificate Checker - Bulk Expiry Monitor

Check SSL/TLS certificates for any domain in bulk. Identify expired, expiring, or misconfigured certificates across your entire domain portfolio.

### What it does

For each domain, this actor connects via TLS and extracts complete certificate details including issuer, expiration, certificate chain, SANs, and negotiated protocol. Use it for:

- **Certificate expiry monitoring** — find certificates expiring in the next 30/60/90 days
- **Security audits** — verify certificate chains, signature algorithms, and TLS versions
- **Compliance checks** — ensure all domains use current TLS standards
- **Domain portfolio management** — bulk-check hundreds of domains at once
- **Vendor risk assessment** — verify SSL health of third-party services

### Input

| Field | Type | Description |
|-------|------|-------------|
| `domains` | Array of strings | Domains to check (e.g., `google.com`, `github.com`) |
| `maxResults` | Integer | Maximum domains to check (default: 100, max: 10,000) |

### Output

```json
{
  "domain": "google.com",
  "isValid": true,
  "issuer": "Google Trust Services",
  "subject": "*.google.com",
  "notBefore": "2026-03-01T00:00:00Z",
  "notAfter": "2026-05-24T00:00:00Z",
  "daysUntilExpiry": 48,
  "isExpired": false,
  "isExpiringSoon": false,
  "serialNumber": "1A2B3C...",
  "signatureAlgorithm": "SHA256-RSA",
  "subjectAlternativeNames": ["*.google.com", "google.com"],
  "certificateChain": ["*.google.com", "GTS CA 1C3", "GTS Root R1"],
  "tlsVersion": "TLS 1.3",
  "cipherSuite": "TLS_AES_128_GCM_SHA256"
}
```

### Pricing

$0.10 per 1,000 domains checked.

### How to use

1. Open [SSL Certificate Checker - Domain TLS Expiry & KYB API](https://apify.com/pink_comic/ssl-certificate-checker) in Apify Console and click **Start** (or **Try for free**).
2. Fill in the input form - start with **Domains**, **Max Results**. Every field is optional unless marked required, and the form is prefilled with a working example.
3. Set **Maximum results** to cap your cost, then run the Actor.
4. Download the results as JSON, CSV, Excel, XML or HTML, or pull them with the Apify API.

#### Example input

```json
{
  "domains": [
    "google.com",
    "github.com",
    "openai.com"
  ],
  "maxResults": 100
}
```

### Output example

One record from a real run (long values shortened, contact details partly masked):

```json
{
  "domain": "google.com",
  "isValid": true,
  "issuer": "Google Trust Services",
  "subject": "*.google.com",
  "notBefore": "2026-10-07T19:07:42Z",
  "notAfter": "2026-12-30T19:07:41Z",
  "daysUntilExpiry": 49,
  "isExpired": false,
  "isExpiringSoon": false,
  "serialNumber": "E2A69220A07404F5128353C50FEF420D",
  "signatureAlgorithm": "ECDSA-SHA256",
  "subjectAlternativeNames": [
    "*.google.com",
    "*.appengine.google.com",
    "*.bdn.dev"
  ],
  "certificateChain": [
    {
      "subject": "*.google.com",
      "issuer": "Google Trust Services"
    },
    {
      "subject": "WE2",
      "issuer": "Google Trust Services LLC"
    },
    {
      "subject": "GTS Root R4",
      "issuer": "GlobalSign nv-sa"
    }
  ],
  "tlsVersion": "TLS 1.3",
  "cipherSuite": "TLS_AES_128_GCM_SHA256"
}
```

### FAQ

#### How much does SSL Certificate Checker - Domain TLS Expiry & KYB API cost?

$0.0001 per ssl check plus $0.0001 per run. For example, 1,000 results cost about $0.10. Higher Apify plans get a Store discount.

#### Do I need an API key or login?

No. Just configure the input and run it.

#### Can I run it on a schedule or from code?

Yes. Use Apify Schedules for recurring runs, or call it from the Apify API, the JavaScript or Python client, Make, Zapier, n8n, or any MCP-compatible AI agent.

#### Why did my run return no results?

Your filters are probably too narrow. Remove a filter or broaden the search, then run again. You only pay the result price for records that are actually saved.

#### Is the data accurate and up to date?

Each run fetches live data from the source described above, so results are as current as that source. Verify critical records with the original source before acting on them.

### Use with the API

```bash
curl -X POST "https://api.apify.com/v2/acts/pink_comic~ssl-certificate-checker/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"domains": ["google.com", "github.com", "openai.com"], "maxResults": 100}'
```

# Actor input Schema

## `domains` (type: `array`):

List of domains to check SSL certificates for. Enter one domain per line (e.g., google.com, github.com).

## `maxResults` (type: `integer`):

Maximum number of domains to check. Use this to control costs.

## Actor input object example

```json
{
  "domains": [
    "google.com",
    "github.com",
    "openai.com"
  ],
  "maxResults": 100
}
```

# Actor output Schema

## `results` (type: `string`):

All records from this run in the default dataset, shown with the Overview table view.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "google.com",
        "github.com",
        "openai.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("pink_comic/ssl-certificate-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "google.com",
        "github.com",
        "openai.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("pink_comic/ssl-certificate-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "google.com",
    "github.com",
    "openai.com"
  ]
}' |
apify call pink_comic/ssl-certificate-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,pink_comic/ssl-certificate-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/wO3ESFiHLdyyhUXeK/builds/ktZyVZhMIqdtJpxgY/openapi.json