Bulk SSL certificate checker: expiry, issuer and name for up to 500 sites
In short: Paste domains or host names and get each one's TLS certificate: days left, expiry date, issuer, the names it covers, and whether it's expired, for the wrong name or not trusted. Limit: Port 443 only, host names that resolve to public addresses only; no IPs, custom ports, SMTP STARTTLS or client certificates.
A bulk SSL checker connects to many websites on port 443 and reads the certificate each one sends. Paste up to 100 domains or host names, or 500 after a Google sign-in, and each shows days left, the expiry date, the issuer and the names covered, labelled Valid, Expires soon (30 days or fewer), Expired, Wrong name or Not trusted. Download it as CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
acme.example's certificate is valid for 64 more days; old.acme.example's expired 9 days ago.
- Host
- acme.example
- Issuer
- Let's Encrypt
- Expires
- 7 Jan 2027
What this means for you
Catch expired, wrong-name and incomplete-chain certificates before visitors see a warning.
- Days left, issuer and covered names
- Expired, wrong-name and untrusted flagged
- Missing intermediate certificates caught
- 100 hosts a run, 500 when signed in
- SSL
- TLS
- Expiry
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français
Checking a client or lead list's websites?
- Paste up to 500 hosts a run when signed in and download the CSV after each. Pair it with the bulk website status checker to see redirects and parked sites.
- A working certificate tells you the site is maintained, not that the email addresses on it work. Upload the contact list at /verify for a mailbox check on each address.
- The first 100 email checks are free with a Google sign-in, no card.
How do I check SSL certificate expiry for many domains?
- Paste domains or host names, one per line, up to 100 a run, or 500 after a free Google sign-in. www.example.com and example.com are checked separately, because they can serve different certificates.
- Press Check certificates. Each host gets one TLS handshake on port 443, ten hosts a request.
- Read each row: status, days left, issuer, validity dates and the names the certificate covers. The list is sorted by days left.
- Pick problems only or expiring soon to see what needs fixing, and download the CSV for your renewal calendar.
Example
- You enter
- Three host names:
acme.example,www.acme.exampleandold.acme.example. - You get
acme.exampleValid, 64 days left, issued by Let's Encrypt;www.acme.exampleWrong name, because the certificate only lists acme.example;old.acme.exampleExpired 9 days ago. Sorted by days left; download the CSV.- Limits
- Up to 100 hosts a run without an account and 500 when signed in with Google. Port 443 only.
How do I check when an SSL certificate expires?
Connect to the site over TLS and read the certificate's notAfter date. This checker does that for each host on your list: one handshake on port 443 with the host name sent as SNI, so a server hosting many sites returns the right certificate. It reads the expiry, the issuer and the subject alternative names, and sends nothing after the handshake.
Certificates are getting shorter. The CA/Browser Forum voted in 2025 to cut the maximum lifetime of public TLS certificates in steps, from 398 days to 200 days from 15 March 2026, 100 days from March 2027 and 47 days from March 2029 (ballot SC-081). Anything renewed by hand needs checking more often.
What do the statuses mean?
Valid: the chain verifies, the certificate lists this host name, and there are more than 30 days left. Expires soon: the same, with 30 days or fewer. Expired: the notAfter date has passed. Wrong name: the certificate doesn't list this host, so browsers warn; wildcards cover one label only, as RFC 6125 sets out, so *.example.com covers www.example.com but not example.com.
Not trusted: the chain didn't verify against the Mozilla CA list built into Node.js. Most often the server left out its intermediate certificate; some browsers fetch it themselves, but many apps, API clients and mail servers fail. Self-signed certificates show here too. No HTTPS: nothing answered TLS on port 443.
Why does a certificate look fine in my browser but fail here?
Usually an incomplete chain. Browsers can download a missing intermediate certificate from the address in the certificate, or have it cached from another site; this checker, like most servers and command-line tools, only uses what the server sends. Install the full chain (your certificate plus the intermediate) on the server to fix it for everyone.
How is this different from checking in the browser?
| This checker | Browser padlock | |
|---|---|---|
| Sites at once | Up to 500 | One |
| Missing intermediate | Reported | Often hidden |
| Days left | Calculated per site | Read the date yourself |
| Export | CSV | No |
Who uses this tool, and for what?
- Agencies
- Check every client site's certificate in one run and catch the ones about to lapse.
- IT teams
- Audit subdomains for expired, wrong-name or incomplete-chain certificates before users see warnings.
- Sales teams
- Spot prospects whose sites show security warnings, a concrete reason to get in touch.
- Cold emailers
- Make sure the redirect sites behind your sending domains serve a valid certificate.
What can’t this tool tell you?
- Port 443 only, host names that resolve to public addresses only; no IPs, custom ports, SMTP STARTTLS or client certificates.
- Trust is checked against Node.js's bundled Mozilla CA list, so a missing intermediate shows as not trusted even where a browser would recover.
- It doesn't check revocation (OCSP or CRL) or Certificate Transparency logs.
- Sites behind some firewalls or bot protection may refuse or time out.
- Up to 100 hosts a run without an account and 500 signed in.
Common questions
- How do I check multiple SSL certificates at once?
- Paste the domains here, one per line. Each one's certificate is read on port 443 and you get days left, expiry, issuer and status in one table, with a CSV download.
- Is this bulk SSL checker free?
- Yes. 100 hosts a run with no account and 500 after a free Google sign-in, no card.
- Does it check www and the bare domain?
- Each line is checked as typed, so add both example.com and www.example.com if you serve both. They often share a certificate, but not always.
- Can it check a port other than 443 or an IP address?
- No. It checks host names on port 443 only, and only hosts that resolve to public addresses.
- Does it monitor certificates and alert me?
- No, it checks when you run it. Download the CSV and put the expiry dates in your calendar, or run the list again each month.
- How long is an SSL certificate valid?
- Up to 398 days for certificates issued before 15 March 2026, and up to 200 days after it, falling to 100 days in 2027 and 47 days in 2029 under the CA/Browser Forum's ballot SC-081. Let's Encrypt certificates last 90 days.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.