# Bulk SSL Checker: Check Up to 50 Certificates at Once

> Check SSL certificates for up to 50 domains in one go: grade, issuer, expiry date, days left and TLS version in one table, exportable as CSV.

Source: https://ssl.sh/tools/bulk-ssl-checker/
Last updated: 2026-11-10

Paste a list of domains and get expiry dates, issuers, grades and problems for all of them in one table.

The bulk SSL checker runs the [SSL checker](https://ssl.sh/tools/ssl-checker/) against a whole list of hosts and puts the results in one table. Paste up to 50 domains, one per line, press **Check all**, then sort by days left or export the table as CSV.

## How to use it

1. Paste host names, one per line. `example.com`, `example.com:8443` and full URLs all work; duplicates are removed.
2. Press **Check all**. Four hosts are checked in parallel and the table fills in as results arrive. The Stop button cancels the remaining checks.
3. Click **Days left** to sort, so the next certificate to expire is at the top.
4. Press **Export CSV** to keep the results or share them with your team.

## What each column means

- **Status**: OK, warning or problem, based on the findings for that host.
- **Grade**: the same A+ to F (and T for untrusted) grade as the single checker.
- **Issuer**: the organisation or CA name in the leaf certificate's issuer field.
- **Expires / Days left**: the leaf certificate's notAfter date. Fewer than 30 days is highlighted, fewer than 15 in red.
- **TLS**: the protocol version negotiated with our client, normally TLS 1.3 or 1.2.
- **Problems**: the warnings and errors found, such as a missing intermediate certificate.

## Tips for certificate inventories

- Include every name you serve: bare domain, `www`, API hosts, mail servers on 465/993 and admin panels on odd ports.
- To find hosts you forgot, search [Certificate Transparency logs](https://ssl.sh/tools/ct-search/) for your domain; every publicly trusted certificate is logged there.
- Certificate lifetimes are getting shorter: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. A manual spreadsheet will not keep up; automate renewal with ACME and monitor expiry continuously.


## FAQ

**Why is the limit 50 hosts?**

Each host needs a full TLS connection from our server, so the browser tool runs at most 50 per run and four at the same time. For larger inventories call the JSON API from a script. ssl.sh Monitor, which will check large inventories on a schedule, is in development.

**Can I check non-standard ports?**

Yes. Write host:port on a line, for example mail.example.com:465 or example.com:8443. Lines without a port use 443.

**What counts as a problem?**

Anything the single SSL checker reports as a warning or error: an expired or soon-expiring certificate, a hostname mismatch, an incomplete or untrusted chain, or old protocols such as TLS 1.0. Click the host to open the full report.

**Does the CSV include all columns?**

Yes: host, port, status, grade, issuer, expiry date, days left, TLS version and the problems text.