How to check SSL certificate expiry for multiple domains

The free SSL certificate checker reads one hostname at a time. That is fine for a quick look at a single site. When you look after ten, fifty, or a few hundred hostnames, checking them one by one stops being practical, and the dates you wrote down last month are already out of date.

This page covers two ways to check a list: a short script you can run yourself today, and scheduled monitoring for when the list needs watching rather than checking.

What you are actually checking

Every TLS certificate (still usually called an SSL certificate) has a not-after date. After that moment, browsers stop trusting it and visitors get a full-page warning instead of the site.

For a list of sites, the question for each hostname is: which certificate is this hostname serving right now, and how many days are left on it? A renewal that happened on the CA's side doesn't help if the server is still presenting the old certificate, so the check has to connect to each hostname and read what it actually serves.

For a deeper explanation of the result, see how to check when an SSL certificate expires.

Check a list with OpenSSL

Put one hostname per line in a file called hosts.txt, then run this in a terminal with OpenSSL installed:

while read -r host; do
  end=$(timeout 10 openssl s_client -connect "$host:443" -servername "$host" </dev/null 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
  if [ -z "$end" ]; then
    echo "$host unknown"
    continue
  fi
  days=$(( ( $(date -d "$end" +%s) - $(date +%s) ) / 86400 ))
  echo "$host $days days left (expires $end)"
done < hosts.txt

Each line of output is a hostname, the whole days left, and the exact expiry time in GMT. A negative number means the certificate has already expired. A hostname that doesn't resolve, refuses the connection, or fails the handshake prints unknown rather than a guessed date.

A few practical notes:

The -servername flag matters. Without it, a server that hosts many sites may hand back a default certificate that isn't the one visitors see.
date -d is GNU date (Linux). On macOS, install GNU coreutils and use gdate, or convert the date another way.
The script only reads the expiry date. It does not check that the hostname is on the certificate, that the chain is complete, or when the domain registration expires.
Sort the output by the days column to see what needs attention first.

Where a script stops being enough

A script gives you a snapshot. It's accurate the moment it runs and then starts to age. To rely on it, someone has to remember to run it, read the output, and act on it, every time, for every client.

That gets harder as certificate lifetimes shrink. Under CA/Browser Forum Ballot SC-081v3, publicly trusted TLS certificates issued from 15 March 2026 can be valid for at most 200 days, falling to 100 days from 15 March 2027 and 47 days from 15 March 2029. More renewals per year means more chances for one automated renewal to fail without anyone noticing. The schedule is explained in what the 47-day SSL certificate limit means for agencies.

Monitor the list instead

Domainvane does the same check on a schedule, for your whole list, and adds the parts a quick script leaves out.

Paste the list once. Hostnames separated by newlines, commas, or spaces. Each one is normalized and deduplicated, and comes back marked added, duplicate, invalid, or over your plan limit. See bulk-adding domains.
Checked about every 24 hours. When a certificate has 7 days or fewer left, or a check is failing, the next check comes sooner, about 6 hours later.
More than the date. For each hostname on port 443: days left, whether the hostname matches the certificate, whether the chain is complete, and whether the certificate is self-signed or not yet valid.
Domain registration too. Domainvane also looks up the domain-registration expiry through RDAP. If there is no usable date, it shows unknown instead of guessing. See domain expiry monitoring.
Alerts at 30, 14, 7, and 1 days, plus a failure alert after 3 consecutive failed checks. They show on the dashboard and go out by email on every plan. Email alerts are delivered to external inboxes, including Gmail; inbox placement is not guaranteed for every provider (Outlook and Yahoo have not been tested).

Domainvane does not renew certificates, and it is not an uptime monitor.

Plans by list size

Plan	Price	Hostnames
Free	$0	3
Solo	$9/mo	25
Agency	$29/mo	150
Agency+	$79/mo	750

Every plan uses the same checks and alert rules. See all plans for webhooks, client report pages, and billing details.

Start free with 3 domains. No card required. Looking after client sites? See monitoring for agencies or monitoring for freelancers.