When to use it
This is the tool for the first week at a new client, the quarterly audit, or the moment someone asks "are any of our sites about to break?" Paste the list from your hosting panel, your invoice spreadsheet or your head. One hostname per line; commas work too. URLs are fine, we strip them down to the hostname.
Each host is checked exactly like the single SSL checker does it: a TLS connection on port 443 with the right SNI name, then the certificate, the chain and the hostname match. We run five checks at a time, so a full list of 25 usually takes well under a minute.
Reading the table
Every row has a small status square and a plain label. Colour is a hint, never the only signal, so the table still reads in greyscale or when printed.
| Label | Meaning |
|---|---|
| 42 DAYS | Valid, trusted, and more than two weeks left. Nothing to do today. |
| 9 DAYS | Valid, but inside 14 days. If this is an automated certificate, renewal has very likely stalled. |
| 2 DAYS / EXPIRED | Inside three days, or already expired. Fix this one first. |
| WRONG HOST | The server returned a certificate for a different name. |
| UNTRUSTED | The chain doesn't verify: self-signed or missing an intermediate. |
| NO CERT | No TLS handshake: DNS, firewall, or no HTTPS on that host. |
| SKIPPED | Not a valid public hostname, so we didn't connect. |
The CSV export
Export CSV builds the file in your browser from the results on screen. Nothing extra is sent to us. Columns: host, status, days left, expiry date (YYYY-MM-DD, UTC), issuer, chain valid, hostname match, renewal verdict and a note. It opens cleanly in Excel, Numbers and Google Sheets, and cells that start with a formula character are escaped so a hostile hostname can't run anything.
What a clean audit looks like
- Fix anything EXPIRED, UNTRUSTED or WRONG HOST first. Visitors are already seeing warnings there.
- Look at every row under 30 days. For Let's Encrypt, ZeroSSL or Google Trust Services certificates that is a stalled renewal, not a normal state.
- Sort by issuer. Hosts with paid, year-long certificates are the ones that need a plan before the maximum lifetime drops to 100 days in March 2027.
- Keep the CSV. Next quarter you can diff it.
Patterns you will probably see
The first bulk check across an agency's client list tends to turn up the same few things. A bare domain and its www twin on different certificates, one of them months older than the other, because only one was added to the renewal. A staging host still serving the self-signed certificate it was set up with. A client who moved hosting last year, whose old server still answers on a forgotten subdomain with an expired certificate. And one site on a paid certificate that renews every year in the same week, which is fine right up until the person who does it goes on holiday.
None of these are dramatic on their own. Together they are the reason certificate outages happen at agencies that were sure everything was automated.
If you already know which hosts matter, stop here. If you suspect there are more, the subdomain certificate finder lists every hostname that has ever had a public certificate under a domain, which is usually a longer list than anyone expected.
From a one-off list to a watched list
The button under the results carries these hosts into a free ExpiryOwl account, grouped under one client. From then on we check every certificate every 6 hours and every domain daily, and send the 30, 14, 7, 3 and 1 day alerts to email, Slack, Teams, Discord, Telegram or a webhook. It is the same table, just one that updates itself and tells you when it changes.