Free SSL Certificate Checker

1. 11

   Enter the domain

   Type a domain such as example.com. A www. or other subdomain is checked as typed, because each name can present its own certificate.

2. 22

   We read the certificate

   1Lookup opens one secure connection to the domain on the standard HTTPS port, asks for its certificate and closes the connection. Nothing else is sent to the site, and an expired or self-signed certificate is still read.

3. 33

   Read the verdict

   You see whether the certificate is valid, expiring soon or has a problem, when it expires, who issued it and whether browsers trust it.

Bulk certificate checks run the same check on a whole list with one CSV file.

The free tool checks one domain at a time. With a 1Lookup account you upload a CSV file in the dashboard, pick the column that holds the domains and download the same file back with the result columns filled in on every row. These rows are invented.

• 2 credits for each certificate that is read, whatever its verdict, about 1 cent on Starter and 0.4 cents on Enterprise, and nothing for a domain with no certificate to read.
• Up to 2 million rows in one CSV file.
• Up to 200 API requests per 10 seconds for each API key, and each account can make up to 1,000 requests a minute in total across all its keys.

The SSL Certificate Check API returns the same verdict as JSON from one request.

Send the domain to the endpoint with your API key. A certificate that is read costs 2 credits, whatever its verdict, and a domain with no certificate to read costs 0. Whether one was read is in classification.found, and the verdict is in classification.certificate_status.

curl -X POST https://app.1lookup.io/api/v1/ssl-certificate-check \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "sample-shop.example.com"}'

import requests

response = requests.post(
    "https://app.1lookup.io/api/v1/ssl-certificate-check",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"domain": "sample-shop.example.com"},
)
data = response.json()["data"]
print(data["classification"]["certificate_status"])

const response = await fetch('https://app.1lookup.io/api/v1/ssl-certificate-check', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ domain: 'sample-shop.example.com' })
})
const { data } = await response.json()
console.log(data.classification.certificate_status)

{
  "success": true,
  "data": {
    "classification": {
      "found": true,
      "host": "sample-shop.example.com",
      "certificate_status": "valid",
      "days_remaining": 38,
      "valid_to": "2026-11-30",
      "issuer": "Sample Trust CA 1",
      "hostname_matches": true,
      "trusted": true,
      "protocol": "TLSv1.3",
      "issue_count": 0,
      "checked_at": "2026-10-23"
    },
    "metadata": { "credits_used": 2, "cache_hit": false }
  }
}

To check every domain you own or monitor from your own software, see our SSL Certificate Check API.

• The verdict comes with the days left.

  You see valid, expiring soon, expired or the problem found, with the expiry date and the number of days left, so a renewal is never a surprise.

• You see whether browsers would trust the certificate.

  The chain of certificates behind it is tested, and the result says whether the name you typed is one of the names it covers.

• An expired or self-signed certificate is still read.

  The check reads what the server really presents, so you see the broken certificate and not just a failed connection.

• A mistyped domain is refused before a check is used.

  An IP address, a single word and anything else that is not a domain name get a clear message and are never looked up.

• 01

  Site owners watching an expiry date

  Check a domain a few weeks ahead to see how many days are left. After you renew, check again: a renewed certificate shows within an hour.

• 02

  Agencies and developers before a launch or a move

  See who issued a certificate, which names it covers and whether it matches the site you are about to switch on.

• 03

  Support teams chasing a browser warning

  Find out whether the warning comes from an expired certificate, the wrong name, a self-signed certificate or a chain browsers do not trust.

• 04

  Reviewers looking at a vendor's website

  Look at the TLS version, the key and the issuer a vendor's public site presents before it goes on an approved list.

• SSL Certificate Check APICheck a whole list of domains, with the verdict, the dates, the issuer and the names for each.
• 1Lookup vs SSL LabsA free full TLS assessment with a grade and restricted use, against a certificate read at a price per domain.
• 1Lookup vs WhoisXML APIPrepaid query tiers with raw certificate fields, against a verdict with the days left at a price per certificate read.
• 1Lookup vs SSLMateCertificate monitoring and a Certificate Transparency search, against a check you run when you ask.
• Free DMARC CheckerCheck the mail authentication record of the same domain.

People who check an SSL certificate also look for these.

• ssl certificate checker
• ssl checker
• check ssl certificate expiry
• ssl certificate expiration date
• https certificate checker
• is my ssl certificate valid
• ssl certificate lookup
• who issued a website's ssl certificate
• check if a certificate is trusted
• ssl certificate check api