Check
Bulk SSL checker
Paste a list of domains and get expiry dates, issuers, grades and problems for all of them in one table.
The bulk SSL checker runs the SSL checker against a whole list of hosts and puts the results in one table. Paste up to 50 domains, one per line, press Check all, then sort by days left or export the table as CSV.
How to use it
- Paste host names, one per line.
example.com,example.com:8443and full URLs all work; duplicates are removed. - Press Check all. Four hosts are checked in parallel and the table fills in as results arrive. The Stop button cancels the remaining checks.
- Click Days left to sort, so the next certificate to expire is at the top.
- Press Export CSV to keep the results or share them with your team.
What each column means
- Status: OK, warning or problem, based on the findings for that host.
- Grade: the same A+ to F (and T for untrusted) grade as the single checker.
- Issuer: the organisation or CA name in the leaf certificate's issuer field.
- Expires / Days left: the leaf certificate's notAfter date. Fewer than 30 days is highlighted, fewer than 15 in red.
- TLS: the protocol version negotiated with our client, normally TLS 1.3 or 1.2.
- Problems: the warnings and errors found, such as a missing intermediate certificate.
Tips for certificate inventories
- Include every name you serve: bare domain,
www, API hosts, mail servers on 465/993 and admin panels on odd ports. - To find hosts you forgot, search Certificate Transparency logs for your domain; every publicly trusted certificate is logged there.
- Certificate lifetimes are getting shorter: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. A manual spreadsheet will not keep up; automate renewal with ACME and monitor expiry continuously.
FAQ
Why is the limit 50 hosts?
Each host needs a full TLS connection from our server, so the browser tool runs at most 50 per run and four at the same time. For larger inventories call the JSON API from a script. ssl.sh Monitor, which will check large inventories on a schedule, is in development.
Can I check non-standard ports?
Yes. Write host:port on a line, for example mail.example.com:465 or example.com:8443. Lines without a port use 443.
What counts as a problem?
Anything the single SSL checker reports as a warning or error: an expired or soon-expiring certificate, a hostname mismatch, an incomplete or untrusted chain, or old protocols such as TLS 1.0. Click the host to open the full report.
Does the CSV include all columns?
Yes: host, port, status, grade, issuer, expiry date, days left, TLS version and the problems text.