Bulk Domain & Certificate Checker
Check a whole portfolio in one run. Paste up to 50 domains — one per line — and this checker reads each domain’s registrar, registration and expiry dates from the registry, then performs a live TLS handshake to read its current certificate. Everything lines up in one sortable table, soonest expiry first, so the domain or certificate that needs attention today sits at the top instead of hiding in a spreadsheet.
Last updated:
Checking the same list every month? Monitor them free with myeventwatch — expiry and downtime alerts, no card required.
What this bulk checker does
Paste up to 50 domains and you get, for every one of them, the facts that decide whether a site stays online: the registrar you actually renew with, the registration date, the domain expiry date with a days-left countdown, and the live TLS certificate the server presents right now — its issuer and its own expiry date. One-off checkers answer one question about one name; this page answers the portfolio question — “of everything I am responsible for, what expires first?” — in a single table. That matters because portfolios fail at their least-watched member: the marketing microsite nobody has opened in a year, the client domain registered by someone who has left, the staging name that quietly became production. Listing them together, with the same columns and the same clock, is what turns a pile of separate renewal dates into one decision you can act on before anything lapses.
Read the table by its two clocks, because a domain and its certificate are different contracts with different owners and different deadlines. The domain expiry is the registration itself: miss it and the name eventually stops resolving at all. The certificate expiry is the TLS certificate served on port 443: miss it and browsers block the site with a warning even though the domain is fine. Either clock can run out first, so the table sorts by whichever deadline is sooner for each row. Treat anything at 30 days or less as a warning — renew it this week, not this month — and anything at 7 days or less, already expired, or serving an invalid certificate as critical: fix it today. A row that could not be checked is shown as an error rather than silently dropped, because “unknown” is itself a finding worth chasing.
Why bulk matters, how it works, and its limits
Checking in bulk matters wherever more than a handful of names share one owner’s attention: a company’s own portfolio of brands, regions and legacy names; the client sites an agency or freelancer maintains; a hosting fleet where every customer brought their own registrar. In those worlds the failure mode is never “we forgot domains expire” — it is “we forgot this domain exists, in that registrar account, under that former colleague’s login”. A single quarterly bulk run catches all three. For a single name you care about in depth, the dedicated tools go further: the domain expiry checker shows the full registry record and DNS for one domain, and the SSL checker inspects one certificate’s chain and protocol in detail. Use bulk to find the fire; use the single checkers to understand it.
The companion guide, check your domains and certificates in bulk, turns this into a routine: why names lapse, the two-clocks habit, and what to do inside the last 30 days. How it works here: for each domain the checker asks the registry over RDAP for the registration record and opens a live TLS handshake to the name to read the certificate it actually serves. Results are cached briefly per domain so repeated checks stay polite to registries, a run accepts at most 50 domains, and one bad domain never fails the batch — its row carries its own error while the other 49 still answer. When the table is on screen you can re-sort it by any column and download it as CSV for a ticket, a report or a renewal calendar.
Honesty and limits. RDAP coverage is not universal: some country-code and older TLDs publish thin records or none at all, so a registrar or a date can legitimately come back blank for a perfectly healthy domain — the row tells you what the registry said, not what we guessed. The certificate is read from port 443 of the name as it resolves publicly, from the checker’s network: a certificate served only to another network, behind a VPN, or on an internal-only name cannot be checked here, and a name that does not resolve publicly will show an error rather than a certificate. A CDN or load balancer can also present different certificates in different places; this page reports the one a public visitor from the checker’s vantage point receives. None of that makes the expiry dates less real — it means a blank or an error deserves a manual look, not an assumption that all is well.
What each column means
| Registrar | The company the domain is registered with — the account where renewal actually happens, which is often not the host or the DNS provider. |
| Domain expires | When the registration itself lapses. Past this date the name enters grace and redemption periods and can eventually be registered by a stranger. |
| SSL issuer | The certificate authority that issued the certificate the server presents today, read from a live TLS handshake, not from a database. |
| SSL expires | When that certificate stops being valid. Browsers warn visitors from this moment even if the domain registration has years left. |
| Status | The row’s urgency, set by whichever clock — domain or certificate — runs out first: OK beyond 30 days, warning at 30 or less, critical at 7 or less, expired or invalid. |
Frequently asked questions
How many domains can I check in one run?
Up to 50 per run, one per line. Paste them, or load a .txt or .csv file — for a CSV only the first column of each line is used, so an exported spreadsheet column works as-is. If you paste more than 50, the page asks you to trim the list rather than silently checking only part of it.
Why do the domain date and the certificate date differ?
They are separate contracts. The domain is registered with a registrar, usually for one to ten years; the certificate is issued by a certificate authority, typically for about a year or less, and lives on the server or CDN. Renewing one never renews the other, which is exactly why this table shows both clocks side by side and sorts by whichever ends first.
A row shows an error. What does that mean?
That domain could not be fully checked: it may not resolve publicly, may not answer on port 443, its TLD may not publish RDAP data, or the registry may have refused the query. The error is shown on that row only — it never fails the rest of the batch. Treat an error as “unknown, look manually”, especially for a name you know should be live.
What happens to the list I paste?
The domains are sent to the sysosx checker, which queries the registries and connects to each name to read its certificate; a public list of domains is required for that to work at all. Results are cached briefly per domain to stay within registry limits. There is no account and no saved portfolio here — for a list you want watched continuously, the monitoring link under the form sets that up in myeventwatch instead.
Can I save or share the results?
Yes — the “Download results as CSV” button exports exactly what the table shows: domain, registrar, creation and expiry dates with days left, certificate issuer and expiry with days left, validity and any errors. It is built in your browser from the results on screen, so the file matches the run you just did, including its sort-independent full set of rows.