Inspect TLS certificate expiry and SHA-256 fingerprints on supplied domains without a browser

SSL/TLS Certificate Scraper bulk-checks certificates on hostnames you already have. It connects at the TLS protocol level (default port 443), reports expiry and issuer details, tracks fingerprint and issuer changes between runs, and can optionally query Google Web Risk. It does not render a browser, does not fetch page HTML, and does not check HTTP status of known URLs or DNS record propagation.

$9.00 per 1,000 delivered monitoring result rows

Open SSL/TLS Certificate Scraper on Apify

TLS certificate inspection, not HTTP status QA or DNS propagation

Use this page when the job is certificate expiry, SHA-256 fingerprints, issuer rotation, and optional reputation on supplied domains. Use Bulk URL Status Checker for live HTTP status, redirect chains, and response timing on a known URL list. Use DNS Propagation Checker for public A/MX/NS (and other) records across eight resolvers.

SSL/TLS Certificate Scraper Bulk URL Status Checker DNS Propagation Checker
Intent TLS cert expiry, fingerprint, issuer, optional Web Risk HTTP status, redirect-chain, timing, and broken-URL QA Audit nameserver and record propagation
Input Hostnames in domains (max 200) Known page URLs in urls (max 1000) Hostnames in domains (max 200)
What it reads TLS on the supplied host (default port 443); no browser Live HTTP(S) responses; it does not crawl pages Public DNS via Node.js dns.Resolver
Primary output Expiry, issuer, cert fields, changes, warnings; optional reputation Status code, final URL, redirect chain, response time, severity Resolved values, TTL, resolver identity, consistency flags
Not this job HTTP status of page URLs; multi-resolver DNS records TLS certificate expiry or fingerprint monitoring TLS handshake or certificate chain inspection

README key features: direct TLS inspection (protocol level, not through HTTP); configurable expiry warnings (default 30 days); fingerprint-change tracking between runs; issuer-change alerts; optional commercially usable Google Web Risk with your own Google Cloud API key; detection of expired, self-signed, and misconfigured certificates.

Use cases

The published README also positions scheduled audits to detect expiring certificates before browsers block access or search engines penalize organic results, extract issuer organization names, pinpoint self-signed certs, and verify active protocol versions. Store Quickstart templates are Quickstart (Dataset), Portfolio Watch, and Webhook Alert. The published FAQ cadence is weekly for production domains; daily if you have high config-change velocity.

How is SSL/TLS Certificate Scraper different from Bulk URL Status Checker and DNS Propagation Checker?

This Actor inspects TLS certificates on hostnames you supply: expiry, issuer, SHA-256 fingerprints, rotation, and optional Google Web Risk. Required input is domains (maximum 200). The Store description states it scans for expiring TLS certs, extracts fingerprint hashes, and can run Google Web Risk malware checks without rendering a browser. Bulk URL Status Checker checks a known URL list for HTTP status, redirect chains, response timing, and broken URL findings. Required input is urls (maximum 1000). It does not crawl pages. DNS Propagation Checker queries public DNS for A, AAAA, MX, TXT, CNAME, NS, and SOA across eight public resolvers. Required input is domains (maximum 200). It does not fetch HTTP(S) HTML. Use this Actor for TLS cert expiry and fingerprint monitoring. Use Bulk URL Status Checker for live HTTP status on URLs you already have. Use DNS Propagation Checker for nameserver and record propagation.

What input is required?

domains is required: List of domains to check SSL certificates for (maximum 200 per run; OpenAPI minItems 1). Schema prefill is google.com, github.com, expired.badssl.com. Optional live schema fields are port (integer, default 443, minimum 1, maximum 65535), expiryWarningDays (integer, default 30, minimum 1, maximum 365), delivery (dataset or webhook, default dataset), webhookUrl (required when delivery is webhook), snapshotKey (string, default ssl-cert-snapshots), concurrency (integer, default 5, minimum 1, maximum 10), emitUnchanged (boolean, default false), dryRun (boolean, default false), enableReputationLookup (boolean, default false), reputationApiKey (required only when Google Web Risk lookup is enabled), and reputationThreatTypes (array, maxItems 3; supported values MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE). additionalProperties is false. The README Input table omits emitUnchanged and the three reputation fields; those names are live schema fields.

Field Type Default Notes
domains string[] required Domains to check SSL certificates for (max 200). Schema prefill: google.com, github.com, expired.badssl.com
port integer 443 TLS port (minimum 1, maximum 65535)
expiryWarningDays integer 30 Alert when the certificate expires within this many days (minimum 1, maximum 365)
delivery string dataset dataset or webhook
webhookUrl string — Required when delivery is webhook
snapshotKey string ssl-cert-snapshots Key name for snapshots used for change detection between runs. The Store example run input uses ssl-certificate-snapshots.
concurrency integer 5 Maximum parallel requests (minimum 1, maximum 10). Higher is faster and may trigger rate limits.
emitUnchanged boolean false Write stable rows to the default dataset. Keep off for recurring monitoring so unchanged runs produce zero dataset rows and zero result charges.
dryRun boolean false Run without saving results or sending webhooks (for testing)
enableReputationLookup boolean false Optional commercially usable Google Web Risk lookup. Disabled by default.
reputationApiKey string — Required only when lookup is enabled. Google Cloud billing/API key, not the non-commercial Safe Browsing API.
reputationThreatTypes string[] — Supported: MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE (max 3). Schema prefill MALWARE.

Published README input example:

{
  "domains": ["google.com", "github.com", "expired.badssl.com"],
  "expiryWarningDays": 30,
  "concurrency": 5,
  "delivery": "dataset"
}

Published Store input-object example (includes schema defaults):

{
  "domains": [
    "google.com",
    "github.com",
    "expired.badssl.com"
  ],
  "port": 443,
  "expiryWarningDays": 30,
  "delivery": "dataset",
  "snapshotKey": "ssl-cert-snapshots",
  "concurrency": 5,
  "emitUnchanged": false,
  "dryRun": false,
  "enableReputationLookup": false,
  "reputationThreatTypes": [
    "MALWARE"
  ]
}

Published Store example run input:

{
  "domains": ["google.com", "github.com", "cloudflare.com"],
  "port": 443,
  "expiryWarningDays": 90,
  "concurrency": 3,
  "delivery": "dataset",
  "snapshotKey": "ssl-certificate-snapshots",
  "dryRun": false
}

The README Single host SSL audit example is domains plus port 443. Bulk monitoring with expiry alerts sends emitUnchanged: false. Recurring certificate and reputation watch sets snapshotKey to production-certificates and enableReputationLookup: false.

Run SSL/TLS Certificate Scraper on Apify

What does a monitoring result contain?

The published README output table lists meta, results, results[].domain, results[].status, results[].cert, results[].changes, results[].warnings, results[].reputation, results[].checkedAt, and results[].error. The published README sample is one row with domain, status (initial), cert (subject, issuer, validFrom, validTo, serialNumber, bits, altNames, authorized, protocol), changes, warnings (type expiring_soon, message, daysLeft), and reputation (provider google_webrisk). The README body also names precise expiry timestamps, SHA-256 fingerprint hashes, and full certificate chain coverage; the sample cert object does not include a fingerprint key. There is no published output JSON schema on the Store page. The sample is a README illustration, not a live coverage guarantee.

Published README sample:

{
  "domain": "google.com",
  "status": "initial",
  "cert": {
    "subject": "CN=*.google.com, O=Google LLC, C=US",
    "issuer": "CN=WR2, O=Google Trust Services, C=US",
    "validFrom": "Jan 27 08:36:26 2026 GMT",
    "validTo": "Apr 21 08:36:25 2026 GMT",
    "serialNumber": "1A2B3C4D...",
    "bits": 256,
    "altNames": ["*.google.com", "google.com"],
    "authorized": true,
    "protocol": "TLSv1.3"
  },
  "changes": [],
  "warnings": [
    {
      "type": "expiring_soon",
      "message": "Certificate expires in 28 days",
      "daysLeft": 28
    }
  ],
  "reputation": {
    "provider": "google_webrisk",
    "status": "clean",
    "uri": "https://google.com/",
    "checkedAt": "2026-02-22T05:00:54.606Z",
    "requestedThreatTypes": ["MALWARE", "SOCIAL_ENGINEERING"],
    "threatTypes": [],
    "hasThreats": false,
    "expireTime": null
  }
}

The published FAQ states this Actor produces evidence artifacts suitable for SOC2 CC7.1 (continuous monitoring). It is not itself a SOC2 certification. Export: use webhook delivery or Dataset API — the README states formats map well to Drata, Vanta, OneTrust import templates.

Does it render a browser or fetch HTTP page HTML?

No. The Store description says without rendering a browser. README key features: Direct TLS inspection — Connects at the protocol level, not through HTTP. README also states validating connections directly at the protocol level rather than heavy web browser rendering. Required input is domains (hostnames), not page URLs. Optional Google Web Risk is off by default. This is not a pentest: the published FAQ states the Actor performs passive compliance scanning only, with no exploitation, fuzzing, or auth bypass. Only scan sites you have authorization for.

HTTP status, redirect chains, and broken-URL QA on URLs you already have belong on Bulk URL Status Checker. Multi-resolver A/MX/NS lookups belong on DNS Propagation Checker. Domain SPF/DMARC/MX grades belong on DMARC & Email Security Checker.

How do unchanged rows, webhooks, and optional Google Web Risk work?

Recurring runs write only initial or changed successful checks to the billable Dataset by default. Stable checks produce 0 Dataset rows and 0 result charges; certificate or reputation lookup failures remain available in the free OUTPUT diagnostic record and are never billed as result rows. emitUnchanged defaults to false; keep it off for recurring monitoring so unchanged runs produce zero dataset rows and zero result charges. Set emitUnchanged true only when you explicitly need stable successful rows. delivery defaults to dataset. Set delivery to webhook and provide webhookUrl to POST results. dryRun true runs without saving results or sending webhooks. enableReputationLookup defaults to false so SSL-only runs behave as before. When enabled, reputationApiKey is required and must be a Google Cloud billing/API key, not the non-commercial Safe Browsing API. Supported threat types are MALWARE, SOCIAL_ENGINEERING, and UNWANTED_SOFTWARE (max 3).

README tips: schedule weekly runs against production domains to catch config drift; use webhook delivery to pipe findings into a SIEM (Splunk, Datadog, Elastic); for CI, block releases on critical severity findings using exit codes. Those tips are README claims; severity is not a column in the published output table.

How is SSL/TLS Certificate Scraper priced?

Billing is pay-per-event. The live Store card is $9.00 / 1,000 delivered monitoring result rows. The billed event is Delivered monitoring result row at $0.009, charged only when a new or changed monitoring result row is delivered. Unchanged runs are free. You are not charged for Apify platform usage, only the fixed event price. Current PPE lists only that event (no actor-start). The README Cost section still quotes actor-start $0.01 plus dataset-item $0.003 ($3.01 for 1,000 items); those figures are not the live Store rates.

$9.00 per 1,000 delivered monitoring result rows ($0.009 per new or changed monitoring result row)

See SSL/TLS Certificate Scraper pricing on Apify

Limits to keep in mind

Open SSL/TLS Certificate Scraper on Apify

Related pages