Check SSL certificates on up to 25 domains at once. Validity, expiry, issuer, TLS version and grade — exportable to CSV.
Single-URL SSL checks are perfect for diagnosing one site. When you manage twenty, fifty, or two hundred domains, they're the slowest possible way to do it. A bulk SSL checker collapses that whole audit into one paste-and-go.
## What this tool does
Paste up to 25 domains, one per line. We run the same live TLS handshake on each one — exactly what the single-URL SSL Checker does — and return a table of certificates with validity, days until expiry, issuer, TLS version, and a grade. Export the whole table to CSV in one click and drop it straight into a client report.
## Why agencies and ops teams use bulk checks
The number one source of preventable downtime in agency-managed site portfolios is an expired certificate that nobody noticed. Browsers slam a full-page warning on the visitor, Google quietly stops indexing new pages, and the client calls you in a panic that afternoon. Bulk SSL checks make 'audit every site every Monday' a five-minute task instead of a 90-minute one.
## Limits
25 domains per run, 3 in parallel. We cap the batch to keep the free service fair and to be a good neighbour to certificate authorities. For continuous monitoring of every domain with SMS/Slack alerts the moment a certificate slips under 30 days, sign up for a free LemWatch account and add the sites once — we'll check daily and alert you automatically.
A single expired certificate breaks HTTPS on a whole site — and across a portfolio of 20+ sites, one slipping through audits is just a matter of when. Bulk checks turn a 20-tab manual sweep into one paste.
For each row, we open a TCP socket to the domain on port 443 and perform a full TLS handshake using Node's TLS library inside an edge function. We do not parse the HTML of the site, render the page, or follow redirects to other hosts — the certificate is read directly from the handshake. We extract: NotBefore, NotAfter, Issuer common name, Subject CNs and SANs, the negotiated TLS version, and the negotiated cipher suite. Days remaining is computed against the current UTC date. The grade is derived from a composite of: certificate validity (must be currently valid), TLS version (1.3 = full marks, 1.2 = partial, anything below is an F), and SAN coverage of the requested hostname. We do NOT use third-party APIs like SSL Labs for the bulk run — every check is a direct handshake we perform ourselves, so results are real-time and unrate-limited by external services.
Paste up to 25 domains, one per line. Each is checked in parallel and returned in a single table with issuer, expiry date and days remaining, so you can spot the certificate about to lapse without visiting 25 sites.
Up to 25 per run. Larger fleets should sign up for continuous LemWatch monitoring where every domain is checked daily with automatic expiry alerts.
No — it runs the same TLS handshake against each domain. The only difference is presentation: a table with CSV export instead of one detail card.
Yes. Mix and match — example.com, www.example.com, api.example.com all work in the same paste.
Usually a DNS failure (the domain does not resolve), a closed port 443 (no HTTPS at all), or a TCP timeout. Click the row to re-run in the single-URL tool for a full diagnostic.
No. We do not log the domain list to analytics. The check is stateless — once the response is sent, the input is discarded.
Live. Every row triggers a fresh TLS handshake at the moment you press the button — we do not cache certificate data.
Paste up to 25 domains, one per line. Each is checked in parallel and returned in a single table with issuer, expiry date and days remaining, so you can spot the certificate about to lapse without visiting 25 sites.