Home SSL Cert Lookup

SSL certificate issuance lookup

ready

Search current unexpired Certificate Transparency issuances for a domain, including matching names, issuer, and validity dates.

last reviewed 2026-10-05.source: SSLMate Cert Spotter API

How it works

This tool queries SSLMate's Cert Spotter Certificate Transparency Search API. The domain endpoint returns current unexpired certificate issuance records matching the name, with expanded DNS names and issuer data. Unauthenticated queries are rate-limited, so retry later if the service returns a limit response.

The result is a set of current unexpired issuance records, not a live TLS handshake. A certificate can appear here even if it was never deployed or has since been replaced. Likewise, the newest logged certificate is not proof that a particular server is presenting it. Use a direct TLS client when you need to verify the certificate currently served on port 443.

Reading the results

DNS names identify the hostnames covered by each issuance, while the issuer is the certificate authority recorded for it. Issued and expiry dates describe that certificate's validity window. The status uses the API's revocation information and compares the expiry date with the current browser time; it does not check hostname matching, the trust chain, or the server configuration.

Certificate Transparency data is useful for finding unexpected issuance and names included in certificates. Treat discovered hostnames as clues: they may not resolve or may not belong to a currently deployed service. Searches and results travel directly between your browser and api.certspotter.com.

FAQ

Where does the cert data come from?
SSLMate's Cert Spotter API indexes public Certificate Transparency logs and coalesces duplicate log entries into issuance records.
Which certificates are shown?
This query lists current unexpired issuances known to Cert Spotter for the domain and matching subdomains.
Why can the lookup be rate-limited?
Cert Spotter permits a limited number of unauthenticated evaluation queries. Wait and retry if the limit is reached.
How do I check the live cert on a server?
CT records do not identify the certificate currently served by a specific server. To inspect the live certificate, use a direct TLS client such as openssl s_client -connect host:443 -servername host.
Does this save my inputs?
The last query persists in localStorage. The query is sent to api.certspotter.com; JustKit does not receive it.