Bulk SSL Expiry Check

Every domain you are responsible for, in one table, sorted by how soon it expires.

What this tool does

Opens a real TLS connection to every host on your list — up to twenty at a time — and returns one table: what each certificate is for, who issued it, when it expires, how many days that leaves, and whether the chain actually verifies. It is the single-domain checker run across an inventory, which is how the question usually arrives: not "is this one fine" but "which of these is about to bite me".

How to use it

Paste one host per line. Commas and spaces work too, so a list copied out of a spreadsheet needs no cleaning up. A port can be appended where the service is not on 443:

example.com — port 443
mail.example.com:993, db.example.com:5432 — anything that speaks TLS on connect

Results come back sorted by urgency, soonest expiry first, so the top of the table is the work list. Duplicates are dropped and the twenty-host cap is per run — each host is a full handshake against someone else's server, and this tool is not a scanner.

Keeping the list

Save list writes the hosts to a plain text file — sslvalid-bulk-ssk-check-2026-08-04-1611.txt, one host per line, stamped so today's save does not land on last month's — and Load list reads one back — so next month's check is a file picker rather than retyping an inventory. Under the results, Download CSV takes the whole table (expiry, days left, issuer, whether the chain verifies) for a spreadsheet or a ticket.

The CSV is also a valid input list: its first column is the host, in the same host:port form the box accepts, so a report from last month loads straight back in. Nothing is stored on this server or in your browser — the file is yours, and where you keep it is your business.

Loading is deliberately forgiving about format. A list exported from anywhere else works too, as long as the hostnames are in there somewhere: one per line, a CSV column, a markdown table or bullet list. Anything that is not shaped like a hostname — dates, issuer names, column headers, table rules — is ignored rather than sent as a host.

Reading the result

Days left — counted from the certificate's own notAfter. Under 30 is amber, under 7 or already expired is red.
Trusted — whether the chain the server sent verifies against a public trust store for the name you asked for. A certificate can be perfectly valid and still fail here: a missing intermediate is the usual reason, and your own browser hides it.
Chain — how many certificates the server sent. One, from a public CA, means the intermediate is missing.
Errors — a host that cannot be reached says so on its own row rather than failing the run.

Why this matters more each year

Certificate lifetimes are dropping to 100 days in 2027 and 47 in 2029. A list you could check by hand once a year becomes a list you check every few weeks, which is the point at which automating issuance with ACME stops being optional. Until that is done everywhere, this table is the cheap version of the same discipline.

Common problems

"Connection timed out". A firewall is blocking this server, or the host does not speak TLS on that port. Internal hostnames are not reachable from here by design.
Trusted says no, but the browser is happy. Almost always the missing intermediate. The chain builder produces the file that fixes it.
A name resolves to a private address. Refused deliberately — this server will not be used to probe networks it happens to sit inside.