SSL & Domain Expiry Monitor - Certificate + RDAP Checks

Certificate expiry and domain-registration expiry for a list of hosts, one row each, with a plain list of what is wrong.

Certificate expiry and domain-registration expiry for a list of hosts, one row each, with a plain list of what is wrong. A real TLS handshake and RDAP - no third-party checking API, no rate limit.

$19.90 / 1,000 · 100.0% success over 26 public runs in the last 30 days.

Run it on Apify → Free to try - runs bill per result on your own account.

What you give it

Every field is optional unless marked; sensible defaults do the rest.

Field	Type	What it does	Default
`domains`	array	One per line. A hostname, a full URL, or host:port. Also accepted under urls, hosts or websites. Leave empty to use the sample list.	`["lowlanddata.com", "apify.com", "expired.badssl.com"]`
`alertThresholdDays`	array	A row is flagged once its countdown falls to one of these. The default ladder warns a month out, then escalates.	`[30, 14, 7]`
`alertsOnly`	boolean	Scheduled monitors want silence when nothing is wrong. Off gives the full audit table for every host.	`False`
`checkDomainExpiry`	boolean	Adds one RDAP lookup per domain: expiry, registrar, statuses and nameservers.	`True`
`timeoutSeconds`	integer	How long to wait for a TLS handshake before recording the host as unreachable.	`15`
`concurrency`	integer	Higher finishes a long list sooner.	`8`
`resetState`	boolean	Forget what was already reported, so the next run alerts on everything again.	`False`
`stateStoreName`	string	Named key-value store holding the last reported state per host.	`ssl-monitor-state`
`maxItems`	integer	Stop after this many rows.	`1000`
`reportFailures`	boolean	When a run fails, send the developer the actor name and build, an error category, the error message (truncated) and a one-way hash of your input - so a bug can be fixed without anyone asking you to reproduce it. Your input itself, your results and your identity are never sent, and successful runs send nothing at all. Switch this off and the actor behaves exactly the same.	`True`

What you get back

One JSON object per result, with exactly these fields - no seller identities, no contact data, ever.

A real result row from a recent run:

{
  "certificateIssuer": "Let's Encrypt",
  "certificateSerialNumber": "063B3A40260608AB1260167A09BB644C72D0",
  "certificateSubject": "lowlanddata.com",
  "certificateValidFrom": "2026-09-06T10:22:08.000Z",
  "certificateValidTo": "2026-12-05T10:22:07.000Z",
  "checkedAt": "2026-10-04T12:32:38.075Z",
  "daysToCertificateExpiry": 61,
  "daysToDomainExpiry": 336,
  "domain": "lowlanddata.com",
  "domainExpiresAt": "2027-09-06T10:58:21.000Z",
  "domainRegisteredAt": "2026-09-06T10:58:21.000Z",
  "domainStatuses": [
    "client delete prohibited",
    "client transfer prohibited"
  ],
  "host": "lowlanddata.com",
  "hostnameMatches": true,
  "isAlert": false,
  "isNewAlert": false,
  "nameservers": [
    "dns111.ovh.net",
    "ns111.ovh.net"
  ],
  "port": 443,
  "problems": [],
  "reachable": true,
  "registrar": "OVH sas",
  "subjectAltNames": [
    "lowlanddata.com"
  ],
  "tlsVersion": "TLSv1.3"
}

Field	Type	Meaning
`host`	string	Hostname checked, as given.
`port`	integer	TLS port used. 443 unless the input said otherwise.
`domain`	string	Registrable domain the RDAP answer describes.
`reachable`	boolean	False when the TLS handshake failed; see error for the reason.
`error`	string	Handshake failure reason. Absent when the host answered.
`certificateIssuer`	string	Issuing certificate authority (organization).
`certificateValidTo`	string	Certificate expiry timestamp (ISO).
`daysToCertificateExpiry`	integer	Whole days left. Negative once expired. Filter on this.
`tlsVersion`	string	Protocol the handshake settled on.
`hostnameMatches`	boolean	Whether the certificate covers this exact hostname.
`domainExpiresAt`	string	Domain registration expiry from RDAP (ISO). Absent where the registry publishes none.
`daysToDomainExpiry`	integer	Whole days until the registration lapses.
`registrar`	string	Accredited registrar company. Never a registrant contact.
`nameservers`	array	Authoritative nameservers on record.
`problems`	array	Machine-readable findings: certificate-expired, hostname-mismatch, self-signed, not-yet-valid, obsolete-tls-version, tls-handshake-failed. Empty when healthy.
`isAlert`	boolean	True when a problem exists or a countdown crossed one of your thresholds.
`isNewAlert`	boolean	True only when this alert differs from what the previous run reported.
`checkedAt`	string	When this row was measured (ISO).

Health

100.0% success over 26 public runs in the last 30 days. Live record, failures included: status page.

Full documentation, examples and the AI-assistant prompt live on the store page.