How many domains can I check at once?

Up to 25 per run. Larger fleets should sign up for continuous LemWatch monitoring where every domain is checked daily with automatic expiry alerts.

Is the bulk check less accurate than the single-URL checker?

No — it runs the same TLS handshake against each domain. The only difference is presentation: a table with CSV export instead of one detail card.

Can I check subdomains and apex domains together?

Yes. Mix and match — example.com, www.example.com, api.example.com all work in the same paste.

What does an "error" row mean?

Usually a DNS failure (the domain does not resolve), a closed port 443 (no HTTPS at all), or a TCP timeout. Click the row to re-run in the single-URL tool for a full diagnostic.

Do you store the list of domains I checked?

No. We do not log the domain list to analytics. The check is stateless — once the response is sent, the input is discarded.

How fresh are the results?

Live. Every row triggers a fresh TLS handshake at the moment you press the button — we do not cache certificate data.

Free Tool

Updated 6 June 2026

Bulk SSL Certificate Checker

Check SSL certificates on up to 25 domains at once. Validity, expiry, issuer, TLS version and grade — exportable to CSV.

By Deepak Shukla — Founder & CEO, Pearl Lemon

Part of SSL certificate monitoring — the full answer, the facts and the alternatives in one place.

Paste your domains — one per line, up to 25

0 URLs ready

What This Tool Checks

SSL certificate validity for every domain
Days remaining until each certificate expires
Issuer (Let's Encrypt, DigiCert, Sectigo, etc.)
TLS protocol version (1.2 / 1.3)
Per-domain SSL grade (A+ to F)

Why This Matters

A single expired certificate breaks HTTPS on a whole site — and across a portfolio of 20+ sites, one slipping through audits is just a matter of when. Bulk checks turn a 20-tab manual sweep into one paste.

How to Fix Issues

1.Sort the CSV by "days_remaining" — anything under 30 days goes on the renewal list this week
2.Set up auto-renewal on every domain returning "Let's Encrypt" (90-day cycles)
3.For domains on TLS 1.2, plan an upgrade to TLS 1.3 for performance and forward secrecy
4.For "F" grades, click the row to open the single-URL SSL Checker for a full diagnostic

Single-URL SSL checks are perfect for diagnosing one site. When you manage twenty, fifty, or two hundred domains, they're the slowest possible way to do it. A bulk SSL checker collapses that whole audit into one paste-and-go.

What this tool does

Paste up to 25 domains, one per line. We run the same live TLS handshake on each one — exactly what the single-URL SSL Checker does — and return a table of certificates with validity, days until expiry, issuer, TLS version, and a grade. Export the whole table to CSV in one click and drop it straight into a client report.

Why agencies and ops teams use bulk checks

The number one source of preventable downtime in agency-managed site portfolios is an expired certificate that nobody noticed. Browsers slam a full-page warning on the visitor, Google quietly stops indexing new pages, and the client calls you in a panic that afternoon. Bulk SSL checks make 'audit every site every Monday' a five-minute task instead of a 90-minute one.

Limits

25 domains per run, 3 in parallel. We cap the batch to keep the free service fair and to be a good neighbour to certificate authorities. For continuous monitoring of every domain with SMS/Slack alerts the moment a certificate slips under 30 days, sign up for a free LemWatch account and add the sites once — we'll check daily and alert you automatically.

Methodology

For each row, we open a TCP socket to the domain on port 443 and perform a full TLS handshake using Node's TLS library inside an edge function. We do not parse the HTML of the site, render the page, or follow redirects to other hosts — the certificate is read directly from the handshake. We extract: NotBefore, NotAfter, Issuer common name, Subject CNs and SANs, the negotiated TLS version, and the negotiated cipher suite. Days remaining is computed against the current UTC date. The grade is derived from a composite of: certificate validity (must be currently valid), TLS version (1.3 = full marks, 1.2 = partial, anything below is an F), and SAN coverage of the requested hostname. We do NOT use third-party APIs like SSL Labs for the bulk run — every check is a direct handshake we perform ourselves, so results are real-time and unrate-limited by external services.

Frequently Asked Questions

This tool also answers

How do I check SSL certificates for multiple domains at once?

Paste up to 25 domains, one per line. Each is checked in parallel and returned in a single table with issuer, expiry date and days remaining, so you can spot the certificate about to lapse without visiting 25 sites.

Monitor this continuously with LemWatch

A one-off bulk ssl certificate checker shows you today. LemWatch re-runs the same checks around the clock and alerts you the moment something breaks — free for up to 10 sites, no card needed.