Google Sheets SSL Expiry Checker is a secure, free, and lightweight solution for checking SSL certificate expiry dates directly inside Google Sheets.
It is built with Google Apps Script on the frontend and a PHP API (MODX or standalone) on the backend.
β
Manager-friendly β works directly in a Google Spreadsheet
β
Secure by design β HMAC signature, HTTPS-only, timestamp validation
β
Cache-enabled β reduces load and blocks spamming
β
Flexible backend β works with MODX or any PHP hosting
β
Free β no paid APIs or SaaS dependencies
| β Without this | π₯ Issue |
|---|---|
| Manual SSL checks | Time-consuming & error-prone |
| No centralized access | Every manager does it differently |
| Public/free APIs | Privacy concerns, rate limits |
| No caching | Risk of overloading the server |
| β Feature | π Benefit |
|---|---|
| Google Apps Script UI in Sheets | No extra training for managers |
| Secure PHP API endpoint | Prevents unauthorized requests |
| HMAC SHA256 signature | Ensures data integrity |
| Timestamp check | Blocks replay attacks |
| MODX System Settings key storage | Easy key rotation |
| File/socket SSL parsing | Direct expiry date retrieval |
| Server-side caching | Protects from overuse |
- Place the
api.phpscript in your hosting root (can be MODX or pure PHP). - If using MODX:
- Create a System Setting named
ssl_checker_api_keyand set your secret key. - Ensure
$modx->cacheManageris available for caching.
- Create a System Setting named
- If using standalone PHP:
- Store
$storedApiKeyin a secure config file. - Replace MODX caching with
file_put_contents()or any cache system.
- Store
- Serve API only over HTTPS.
- Open your Google Sheet.
- Go to Extensions β Apps Script.
- Paste the provided Google Apps Script code.
- In the sheet, open the βοΈ GM SCRIPTS menu and run SSL CHECKER.
- Enter:
- API URL (
https://yourdomain.com/api.php) - API Key (from backend)
- Column with domains
- Column to update with expiry dates
- API URL (
- Done β β all expiry dates will be fetched securely.
- HTTPS-only β request rejected if not over TLS
- HMAC SHA256 β verifies request authenticity
- Timestamp validation (Β±30s) β blocks replay attacks
- Server-side cache (60s default) β reduces load & spam
- Minimal exposed surface β only one POST endpoint
- Maxum post content size β is 500 KB
- π Saves hours β no manual SSL checks
- π Centralized view of certificate expiry dates
- π No public API leakage
- β‘ Fast due to caching
| Component | Details |
|---|---|
| Language | PHP 7+ |
| Database | MySQL / MariaDB (MODX) or none (standalone) |
| Frontend | Google Apps Script |
| Security | HMAC + HTTPS + Timestamp |
| Caching | MODX CacheManager or custom |
| Compatibility | Any HTTPS-enabled PHP hosting |
MIT β free to use, modify, and integrate.
β If this tool saved you time β give it a star on GitHub and share with your colleagues!