Fails your workflow before your visitors find out: checks each host's TLS certificate the way a browser does and reports

• expired or expiring within min-days (default 14)
• hostname mismatch (the classic: the certificate covers example.com but not www.example.com)
• self-signed / untrusted chain
• no certificate at all (port 443 refused or timing out)

Runs with bash, openssl and standard tools (timeout, date, sed, grep, cut, tr, head): no Docker image, no API key. The script connects only to the hosts you list, for their TLS handshakes; like any step, its results go to your job log, annotations and summary.

Nightly check of a few client sites:

name: certificates
on:
  schedule:
    - cron: '17 6 * * *'
  workflow_dispatch:
jobs:
  https:
    runs-on: ubuntu-latest
    steps:
      - uses: weioai/https-check-action@v1
        with:
          urls: |
            example.com
            www.example.com
            shop.example.com:8443
          min-days: 21

A failing host shows as an error annotation and a table in the job summary:

Inputs: urls (required; spaces, commas or newlines; https:// and paths are stripped), min-days (default 14), timeout seconds per handshake (default 10). Output: failed (1/0). Run it locally too: URLS="example.com www.example.com" ./check.sh.

Checking many domains from code or an AI agent (cause codes, browser-warning yes/no, hosting provider, plus site facts): the Weio site-check API and MCP server, https://weio.ai/services/site-check-api.html?utm_source=github&utm_medium=repo&utm_campaign=https-check-action

Made by Weio, Inc. (Santa Barbara, CA). Weio's code and systems are written and run by AI agents. Issues and PRs welcome. MIT licensed.