Certificate validation
Verify validity, issuer trust, signature algorithm, and proper configuration.
SSL / TLS certificates
Every certificate logged for a domain
Issuer, validity dates and covered names from public Certificate Transparency logs. Alerts when a monitored domain gets a new certificate.
Free analysis · 50 free lookups a month · No credit card
Data
What a lookup returns for each certificate
Six layers of inspection — designed to surface issues before users see browser warnings.
Chain verification
Walk the full chain from leaf to root, flagging missing intermediates and broken links.
Protocol audit
Detect supported TLS versions; flag deprecated SSL 3.0, TLS 1.0, TLS 1.1.
Cipher suite audit
Identify weak ciphers (RC4, 3DES, CBC) and recommend AEAD alternatives.
Expiration monitoring
Track expiry across your fleet and alert before browser warnings hit users.
CT log monitoring
Watch Certificate Transparency logs for unauthorized issuance against your domains.
API output
What the API returns field by field
Sample response from GET /check/certificates?query=example.com
CT log entry
example.comvalidStatic sample. Fields as crt.sh returns them for one logged certificate.
Common nameexample.comIssuerLet's Encrypt R11Expires2026-12-13
| Field | Value | Source | Age | Conf. |
|---|---|---|---|---|
| Certificate | ||||
| low severitycommon_name | example.com | crt.sh | 2 min | 1.00 |
| not applicablename_value | "example.com\n*.example.com" | crt.sh | 2 min | 1.00 |
| low severityissuer_name | C=US, O=Let's Encrypt, CN=R11 | crt.sh | 2 min | 1.00 |
| not applicableserial_number | 035c981da3… | crt.sh | 2 min | 1.00 |
| Validity | ||||
| low severitynot_before | 2026-09-14T08:14:03 | crt.sh | 2 min | 1.00 |
| low severitynot_after | 2026-12-13T08:14:02 | crt.sh | 2 min | 1.00 |
| not applicableentry_timestamp | 2026-09-14T09:14:03 | crt.sh | 2 min | 1.00 |
Monitor the domain to receive expiry and CT-log alerts via webhooks or the SSE stream.
Use cases
Who uses it and why
DevOps teams
Check the expiry dates of the certificates on each of your domains.
Security teams
Spot certificates issued for your domains that nobody requested.
Compliance
Meet PCI DSS, HIPAA, and ISO requirements for TLS configuration with auditable reports.
Third-party risk
Review a vendor’s certificate history before you integrate with them.
FAQ
Frequently asked questions
What does a lookup return?
The certificates logged for the domain in public CT logs: common name, SAN entries, issuer, serial number and validity dates.
Can I monitor a domain’s certificates?
Yes. Add the domain to monitoring and an alert is raised when a certificate is added or removed, or when its issuer changes.
Where does the data come from?
From crt.sh, which indexes public Certificate Transparency logs. A domain that is not in our cache is fetched from crt.sh at lookup time.
Do you test TLS versions and cipher suites?
No. CT logs describe certificates, not server configuration. Use a TLS scanner such as SSL Labs to test protocols and ciphers.
Is there an API?
Yes: GET /check/certificates?query=example.com with a free API key (50 requests a month). Higher-volume monitoring, with continuous tracking and webhooks, comes with paid plans; SSE alerts require Pro or Enterprise.
How do you compare to SSL Labs?
SSL Labs is excellent for one-shot interactive testing. We focus on continuous monitoring across an asset inventory, machine-readable JSON output, programmatic alerts, and CT-log surveillance — designed to drop into SOC and DevOps pipelines, not just web browsers.
Monitoring
Get alerted when a new certificate appears
A free API key with 50 lookups a month. Continuous monitoring on paid plans.
No credit card required