How to Check SSL Certificate Expiry for Many Websites at Once

You can check the SSL certificate expiry of many websites in one run by connecting to each one on port 443 and reading the certificate it sends. The bulk SSL checker does that for up to 100 domains with no account, or 500 after a free Google sign-in. Each site comes back with days left, the expiry date, the issuer and the names the certificate covers, labelled Valid, Expires soon, Expired, Wrong name or Not trusted, and you can download the table as a CSV.

Checking one site by clicking the padlock is easy. Checking forty client sites before the Monday morning call is where a list tool pays off.

Why this matters more every year

Certificates are getting shorter. The CA/Browser Forum voted in 2025 to reduce the maximum lifetime of public TLS certificates in steps (ballot SC-081):

From	Maximum lifetime
Before 15 March 2026	398 days
15 March 2026	200 days
March 2027	100 days
March 2029	47 days

Anything that is renewed by hand, or by an automation nobody has looked at since it was set up, needs checking more often than a yearly reminder. A certificate that lapses puts a full-page browser warning in front of every visitor, and it can also break API clients and mail servers that connect to the same host name.

Step 1: list the host names

Paste one host name per line, for example:

example.com
www.example.com
shop.example.com

Add both the bare domain and the www version if you serve both. They often share a certificate, but they can serve different ones, so each line is checked exactly as typed. Only host names that resolve to public addresses are checked: no IP addresses, no custom ports.

Step 2: run the check

Open the bulk SSL checker and press Check certificates. For each host the tool makes one TLS handshake on port 443, sending the host name (SNI) so a server that hosts many sites returns the right certificate. It reads the expiry, the issuer and the subject alternative names, and sends nothing after the handshake. Hosts are checked ten at a time.

Step 3: read the status

Status	Meaning
Valid	The chain verifies, the certificate lists this host name, and more than 30 days remain
Expires soon	The same, with 30 days or fewer left
Expired	The certificate's end date has passed
Wrong name	The certificate doesn't list this host, so browsers warn
Not trusted	The chain did not verify against the Mozilla CA list built into Node.js
No HTTPS	Nothing answered TLS on port 443

Two of these deserve a closer look.

Wrong name. Names on a certificate are matched as RFC 6125 describes. A wildcard covers one label only, so *.example.com covers www.example.com but not example.com and not a.b.example.com. A site that works on www but shows a warning on the bare domain is the classic case.

Not trusted. Most often the server left out its intermediate certificate. Some browsers fetch a missing intermediate themselves, so the site looks fine to you while an app, an API client or a mail server fails. Self-signed certificates also land here.

Step 4: sort and export

Results are sorted by days left, so the sites closest to expiry sit at the top. Pick "problems only" or "expiring soon" to see what needs action this week, and download the CSV to paste into a renewal calendar or a ticket. If you manage client sites, send the CSV with the client name added in the next column.

A certificate that fails here but works in your browser

The usual reason is an incomplete chain. A browser can download a missing intermediate from the address inside the certificate, or have it cached from another site. This checker, like most servers and command-line tools, only uses what the server sends. The fix is to install the full chain, your certificate plus the intermediate, on the server. After that it works for everyone, not just for the browsers that guess.

What this check does not do

• It checks host names on port 443 only. No IP addresses, custom ports, SMTP STARTTLS or client certificates.
• Trust is judged against Node.js's bundled Mozilla CA list, so a missing intermediate shows as Not trusted even where a browser would recover.
• It does not check revocation (OCSP or CRL) or Certificate Transparency logs.
• Sites behind some firewalls or bot protection may refuse the connection or time out.
• It checks when you run it. It does not monitor and alert.

Use it on the sites you email or sell to

A working certificate tells you a site is maintained. It tells you nothing about whether the email addresses on it work. If the list you are checking is a lead or client list, pair this with a look at redirects and parked pages in the bulk website status checker, and check your email addresses before you send. For sending domains, see check a new domain is ready to send email and parked domain emails.

Check your own sites

Paste your hosts into the bulk SSL checker and download the CSV. If the same list has contact emails, upload it on the verify page: the first 100 email checks are free with a Google sign-in, no card, and every address comes back valid, risky or invalid with a reason. Nothing is sent to the people on the list. For recurring or larger lists see bulk email verification and pricing.