SSL Certificate & Security Header Audit

Know before your certificate expires — and see which security headers are missing — across every domain you own, in one scheduled run.

Reads the certificate straight from a TLS handshake, so it reports what a browser would actually see: issuer, validity window, hostname coverage, chain trust and negotiated TLS version. Then it checks the six headers that materially change a site's security posture, and grades the result A to F.

What you get

{
  "domain": "github.com",
  "grade": "A",
  "score": 96,
  "isExpired": false,
  "daysUntilExpiry": 40,
  "validTo": "2026-09-30T23:59:59.000Z",
  "issuer": "Sectigo Limited",
  "isValidForHost": true,
  "trustedByNode": true,
  "tlsProtocol": "TLSv1.3",
  "cipher": "TLS_AES_128_GCM_SHA256",
  "missingSecurityHeaders": ["Permissions-Policy"],
  "issues": ["Missing security headers: Permissions-Policy."]
}

An expired certificate is reported, not skipped — expired.badssl.com returns grade F with isExpired: true, daysUntilExpiry: -4149 and the untrusted-chain reason.

Main use cases

• Certificate expiry monitoring. Schedule weekly and alert on daysUntilExpiry < 30. An expired cert takes a site down.
• Portfolio audits across every domain and subdomain you own.
• Vendor and acquisition due diligence.
• Compliance evidence — HSTS, CSP, X-Frame-Options coverage as a CSV.
• Post-deploy verification that a renewal actually rolled out.

What is graded

Check	Weight
Certificate valid and not expiring within 30 days	35
Certificate covers the hostname (wildcard-aware)	15
Chain trusted by a real trust store	15
Modern TLS (1.2 / 1.3)	10
Security headers present	up to 25

Wildcard matching follows browser rules: *.example.com covers a.example.com but not a.b.example.com.

Pricing

Event	Price	When
Domain audited	$0.003	One domain with a completed handshake and header check

Domains where the TLS handshake failed entirely are not charged — there is nothing useful to return.

1,000 domains = $3.00.

Input

Field	Type	Default	Notes
domains	array	required	Ports and paths stripped automatically. Up to 5,000.
concurrency	integer	8	Parallel handshakes.

Limitations

• Port 443 only. Mail and other TLS services on different ports are not checked.
• Configuration, not a penetration test. It reads the certificate and headers; it does not test cipher downgrade, vulnerability classes, or header values beyond presence.
• Header checks need a working certificate. If TLS fails, headers cannot be read — reported in issues rather than silently omitted.
• Grades are this Actor's own scoring model, not an industry standard such as SSL Labs.

Related Actors

• Bulk Email Deliverability Auditor — SPF, DKIM and DMARC for the same domains.
• Bulk URL Status & Redirect Chain Checker — HTTP-level health for the same list.

Reliability

• Retries on 429 and 5xx with exponential backoff; permanent 4xx errors are not retried.
• Bad input is reported and skipped, never charged.
• One failing target never aborts the rest of the run.
• Concurrency is bounded and configurable — this work is network-bound, so parallel requests, not memory, are what control speed.

Data source and responsible use

Reads only publicly available data. No authentication bypass, no CAPTCHA circumvention, no browser automation.

Not affiliated with any of the services checked.