--- title: "Bulk SSL Certificate Checker — free tool" description: "Free bulk SSL checker. Audit up to 25 domains in one go. Expiry, issuer, TLS version, grade. CSV export. No signup." canonical: "https://lemwatch.com/tools/bulk-ssl-checker" source: "https://lemwatch.com" --- # Bulk SSL Certificate Checker > Check SSL certificates on up to 25 domains at once. Validity, expiry, issuer, TLS version and grade — exportable to CSV. Single-URL SSL checks are perfect for diagnosing one site. When you manage twenty, fifty, or two hundred domains, they're the slowest possible way to do it. A bulk SSL checker collapses that whole audit into one paste-and-go. ## What this tool does Paste up to 25 domains, one per line. We run the same live TLS handshake on each one — exactly what the single-URL SSL Checker does — and return a table of certificates with validity, days until expiry, issuer, TLS version, and a grade. Export the whole table to CSV in one click and drop it straight into a client report. ## Why agencies and ops teams use bulk checks The number one source of preventable downtime in agency-managed site portfolios is an expired certificate that nobody noticed. Browsers slam a full-page warning on the visitor, Google quietly stops indexing new pages, and the client calls you in a panic that afternoon. Bulk SSL checks make 'audit every site every Monday' a five-minute task instead of a 90-minute one. ## Limits 25 domains per run, 3 in parallel. We cap the batch to keep the free service fair and to be a good neighbour to certificate authorities. For continuous monitoring of every domain with SMS/Slack alerts the moment a certificate slips under 30 days, sign up for a free LemWatch account and add the sites once — we'll check daily and alert you automatically. ## What this tool checks - SSL certificate validity for every domain - Days remaining until each certificate expires - Issuer (Let's Encrypt, DigiCert, Sectigo, etc.) - TLS protocol version (1.2 / 1.3) - Per-domain SSL grade (A+ to F) ## Why it matters A single expired certificate breaks HTTPS on a whole site — and across a portfolio of 20+ sites, one slipping through audits is just a matter of when. Bulk checks turn a 20-tab manual sweep into one paste. ## How to fix what it finds - Sort the CSV by "days_remaining" — anything under 30 days goes on the renewal list this week - Set up auto-renewal on every domain returning "Let's Encrypt" (90-day cycles) - For domains on TLS 1.2, plan an upgrade to TLS 1.3 for performance and forward secrecy - For "F" grades, click the row to open the single-URL SSL Checker for a full diagnostic ## Methodology For each row, we open a TCP socket to the domain on port 443 and perform a full TLS handshake using Node's TLS library inside an edge function. We do not parse the HTML of the site, render the page, or follow redirects to other hosts — the certificate is read directly from the handshake. We extract: NotBefore, NotAfter, Issuer common name, Subject CNs and SANs, the negotiated TLS version, and the negotiated cipher suite. Days remaining is computed against the current UTC date. The grade is derived from a composite of: certificate validity (must be currently valid), TLS version (1.3 = full marks, 1.2 = partial, anything below is an F), and SAN coverage of the requested hostname. We do NOT use third-party APIs like SSL Labs for the bulk run — every check is a direct handshake we perform ourselves, so results are real-time and unrate-limited by external services. ## This tool also answers ### How do I check SSL certificates for multiple domains at once? Paste up to 25 domains, one per line. Each is checked in parallel and returned in a single table with issuer, expiry date and days remaining, so you can spot the certificate about to lapse without visiting 25 sites. ## Frequently asked questions ### How many domains can I check at once? Up to 25 per run. Larger fleets should sign up for continuous LemWatch monitoring where every domain is checked daily with automatic expiry alerts. ### Is the bulk check less accurate than the single-URL checker? No — it runs the same TLS handshake against each domain. The only difference is presentation: a table with CSV export instead of one detail card. ### Can I check subdomains and apex domains together? Yes. Mix and match — example.com, www.example.com, api.example.com all work in the same paste. ### What does an "error" row mean? Usually a DNS failure (the domain does not resolve), a closed port 443 (no HTTPS at all), or a TCP timeout. Click the row to re-run in the single-URL tool for a full diagnostic. ### Do you store the list of domains I checked? No. We do not log the domain list to analytics. The check is stateless — once the response is sent, the input is discarded. ### How fresh are the results? Live. Every row triggers a fresh TLS handshake at the moment you press the button — we do not cache certificate data. ### How do I check SSL certificates for multiple domains at once? Paste up to 25 domains, one per line. Each is checked in parallel and returned in a single table with issuer, expiry date and days remaining, so you can spot the certificate about to lapse without visiting 25 sites. ## Related - [All free tools](https://lemwatch.com/tools) - [SSL Checker](https://lemwatch.com/tools/ssl-checker) - [Security Headers](https://lemwatch.com/tools/security-header-checker) - [Bulk Security Header Checker](https://lemwatch.com/tools/bulk-security-headers) - [Bulk DNS Lookup Tool](https://lemwatch.com/tools/bulk-dns-lookup) - [Lemwatch pricing](https://lemwatch.com/pricing) - [All monitoring checks](https://lemwatch.com/features) - [Bulk Website Uptime Checker](https://lemwatch.com/tools/bulk-uptime-check)