01Where does this data come from?
Since 2018, every certificate authority must publish each certificate it issues to public, tamper-proof logs: Certificate Transparency (CT). Browsers reject certificates absent from these logs. As a result, any domain's certificate history is public — this tool queries it live through the Cert Spotter API.
Common uses: confirm a renewal actually happened, watch the expiry date (the number one cause of “site unreachable” outages), detect a certificate issued without your knowledge (compromise or an overzealous vendor), or inventory exposed subdomains. For the domain's DNS side, see our DNS lookup and our whois.
02Understanding the results
- Issuer
- The certificate authority (CA) that signed the certificate: Let's Encrypt, Google Trust Services, Sectigo, DigiCert… Free or paid, they all provide the same level of encryption.
- Covered names
- The domains listed in the certificate (SAN). A wildcard *.example.com covers every first-level subdomain.
- Expiry
- Past this date, browsers show a blocking error. Current certificates last at most 398 days; Let's Encrypt issues for 90 days.
- Revoked
- The certificate was invalidated before its expiry (compromised key, reissuance). A revoked certificate still in service is a red flag.
- Duplicates
- The same renewal often appears several times: precertificate + final certificate, or variants covering different names. This is normal.
03From the command line
The same URL as this page answers in plain text (one line per certificate), and the JSON API returns the structured list (open CORS) — handy to alert before expiry:
$ curl "its-my-ip.com/tls?domain=exemple.fr" 2026-05-02T09:00:00Z 2026-07-31T09:00:00Z 4d Let's Encrypt exemple.fr,www.exemple.fr $ curl "its-my-ip.com/api/tls?domain=exemple.fr" { "total": 3, "certs": [ { "issuer": "Let's Encrypt", "notAfter": … } ] }
04Frequently asked questions
Why do I see certificates I never requested?
Three benign causes cover nearly every case: precertificates (each issuance appears twice in the logs), automatic renewals by your host or CDN (Cloudflare, Vercel… issue on your behalf), and multi-name certificates where your domain sits alongside others. An issuer that neither you nor your vendors use, however, deserves investigation.
How do I get alerted before a certificate expires?
Query this tool's JSON API from a cron job or your monitoring and alert under 30 days remaining. In practice, prefer automatic renewal (ACME/certbot, or your host's): the alert then only serves to catch renewals that failed.
Does Certificate Transparency expose my “secret” subdomains?
Yes: any certificate naming admin.example.com or vpn.example.com makes that name public forever in the CT logs. If a subdomain must stay unknown, use a wildcard certificate (*.example.com) which does not reveal individual names — and remember that a hidden name is not a protection: put real authentication in front.
What should I do if my certificate has expired?
Renew it, then reload the server configuration (certificates are read at startup). With certbot, check the renewal timer (systemctl list-timers); behind a CDN like Cloudflare, visitors see the CDN's certificate, renewed automatically — an expired origin certificate is then invisible to visitors but breaks the CDN-to-origin link.
Why does the list differ from crt.sh?
Both services read the same CT logs but present them differently: this tool (through Cert Spotter) groups precertificate and final certificate into one “issuance” and only shows unexpired certificates by default. crt.sh lists every raw entry, full history included, hence much larger volumes.