All tools

Free tool

Bulk SSL checker

Check the certificates and registrations of up to 10 domains at once, in one table you can sort. Free, no account.

Up to 10, one per line. Commas or spaces work too.

Or try a sample list.

What the table shows

Certificate expires
When the domain’s TLS certificate stops being valid, and how many days are left, counted in calendar days in UTC. Where a domain’s addresses serve different certificates, this is the valid one that expires soonest, since some visitors get it; a certificate that isn’t valid, on any address, shows under Problems. If none is valid, this is the one that expires soonest.
Issuer
The certificate authority that signed it, and the intermediate it used, such as Let’s Encrypt R11.
Problems
What needs a look, the most serious first: an expired, untrusted or wrong-name certificate, a problem on some of the domain’s addresses, a registration that has expired, a certificate that expires within 14 days or a registration within 30, or a check that couldn’t finish and why. “None found” means a valid certificate with more than 14 days left, and no registration we could read expiring within 30.
Addresses
How many of the domain’s server addresses we checked, out of how many its DNS gives. Open the domain for what each one served.
Registration expires
When the domain registration itself runs out, from its registry over RDAP. Subdomains are looked up as the domain they belong to. Where we can’t get a date from the registry, the column says so; check the renewal date with your registrar.

Press a column heading to sort by it, soonest or most serious first; press it again to reverse. Each domain links to its full report on the SSL certificate checker.

Check a list from the command line

With OpenSSL, this prints each domain’s certificate expiry (notAfter), one domain per line of domains.txt:

Terminal 
while read -r d; do
  printf "%s " "$d"
  openssl s_client -connect "$d:443" -servername "$d" </dev/null 2>/dev/null | openssl x509 -noout -enddate
done < domains.txt
Output 
example.com notAfter=Dec 25 22:56:35 2026 GMT
wikipedia.org notAfter=Jan  2 18:34:50 2027 GMT

Run on October 24, 2026 with OpenSSL 3.6.4. Each line comes from the one address OpenSSL happened to connect to, and says nothing about the chain, the name or the registration; the table above checks all of those, on each address it checks.

Watch the list, not just check it

A check tells you about today. Once the run is done, Watch these domains opens Expiry Watch with the list filled in: add your email, review the list, and confirm it from one email. From then on we check every domain daily and email you if a certificate’s renewal looks late, or before a certificate or registration expires. Nothing is watched until you confirm.

How the check works

Each domain is checked like a single one on the SSL certificate checker, three at a time: we resolve it, complete a TLS handshake on port 443 with each of its addresses, up to 4 IPv4 and 4 IPv6, read the certificates, and disconnect. We don’t load pages, send any data or follow redirects, and we never connect to private or reserved addresses. The registration date comes from the domain’s registry over RDAP.

Questions

Something else? Send us a note, right from the page.

Is the bulk SSL checker free?

Yes, with no account. Check up to 10 domains at a time, as often as you need. Watching them, with email alerts, is free for up to 10 domains.

Why 10 domains at a time?

Each domain gets the same check as the SSL certificate checker: its server addresses (up to 4 per IP version), the chain, and the registry. 10 at a time keeps that quick and leaves room under the limit of about 20 checks a minute per connection, so you can check a list, fix something and check it again.

It is also what Expiry Watch watches for free, so the whole list goes straight into one confirmation.

Does it check every server a domain has?

The addresses its DNS gives us, up to 4 IPv4 and 4 IPv6, the same ones each time. The table shows how many were checked out of how many there are; open a domain for what each address served. A load balancer behind one address answers with one of its servers, so a bad server behind it may not show on a given day.

What does “check failed” mean in a row?

We couldn’t complete a TLS connection to that domain: no DNS record, nothing on port 443, a firewall, or a server that doesn’t speak TLS. The row says which.

It is never counted as expired. If several rows say “didn’t finish”, they were waiting when the check limit was reached; check them again a minute later.

Do you keep the domains I check?

We don’t keep a history of your checks or tie them to you. Registry answers are reused for up to 12 hours so repeat lookups are quick, then deleted within a week, and like any web service our request logs are kept for a few days.

Watch them all with one email.

Expiry Watch checks up to 10 domains every day, free, and emails you if a certificate’s renewal looks late, or before a certificate or a registration runs out. One email confirms the whole list.

Watch up to 10 domains