Bulk-Domain-Checker

What each domain is checked for

Every domain on the list goes through the same scan as the Domain Signature Health report: ecdsa.com connects to the domain on port 443, reads the certificate chain it serves, and grades what it finds — the protocol version (TLS 1.3 or older, RFC 9846), whether TLS 1.0 and 1.1 are still accepted (RFC 8996 deprecated them), the key and signature algorithms of the certificate, how long it is valid and when it expires, and whether the chain is complete up to a root. The table shows the grade, the days left on the certificate with its key, and the TLS findings for each domain; the domain links to its full report.

Expiry is where a list pays off. Publicly trusted certificates now last 200 days at most, 100 from March 2027 and 47 from March 2029 (CA/Browser Forum ballot SC-081 — see the 47-day calculator), so a renewal that silently failed is a matter of weeks. The summary counts expired certificates and those that expire within 14 and 30 days, the same thresholds the health report warns at.

Why ten a minute

The checks run through ecdsa.com's public API, GET /api/v1/health/{domain}, the same operation available to scripts and the SDKs. A scan opens real connections to someone else's server, so the API limits how many a client may start: ten a minute from one address, and a few per host in any ten minutes, whoever asks. The page keeps to that pace by itself — one request at a time, at least six seconds apart — so 25 domains take about two and a half minutes. If the API still answers "too many requests", the page waits as long as the answer's Retry-After header says and tries again; a scan that timed out or found the server unreachable is tried once more; a name that does not resolve is reported at once. Results the API scanned in the last hour come from its cache and say so. Without an account a batch holds 25 domains.

How the list is read

Paste whatever you have: one name per line, a spreadsheet column, a comma-separated export, or URLs copied from a browser — only the host counts. Internationalized names are converted to their ASCII form the way browsers do, duplicates are dropped with a note pointing at the first occurrence, lines starting with # are comments, and every entry that cannot be checked — an IP address, a single-label name, a wildcard — gets a precise reason before anything is sent.

Exports

CSV has one row per domain with stable column names — grade, score, certificate expiry and days left, key algorithm and curve, TLS 1.3, legacy TLS, chain, the finding identifiers, the error code when a check failed — in the RFC 4180 format spreadsheets read. Text that a spreadsheet would run as a formula (a certificate subject chosen by whoever controls a server can start with =) is neutralised with a leading apostrophe. JSON carries the same rows with the API's full answer for each domain, the summary, a format name and a version, for scripts.

What leaves your browser

The list is parsed and the summary computed in your browser. Pressing Check sends each domain name, and nothing else, to ecdsa.com's API on this same site; the API connects to that domain and keeps the scan in its cache for an hour, so repeated checks do not hit the domain again. A share link carries the list after the # of the address — never the results — and running it again is up to whoever opens it. Post-quantum key exchange is not part of this batch yet; for one server, see how browsers negotiate it with the post-quantum browser check and configure it with the TLS configuration generator.