Public, append-only records of all SSL certificates from participating CAs. Help detect unauthorized certificates.

Can I check any domain?

Yes. CT logs are public. Useful for verifying your own domains and investigating suspicious ones.

What does self-signed mean?

Not issued by a trusted CA. Provides encryption but no identity verification. Inappropriate for production.

How often should I check?

At least monthly. Set up automated monitoring. Let's Encrypt certs expire every 90 days.

SSL Inspector

Free online SSL/TLS certificate checker. Check certificate health via Certificate Transparency logs — expiry date, issuer, chain, and security grade.

Free online SSL/TLS certificate checker. Check certificate health via Certificate Transparency logs — expiry date, issuer, chain, and security grade. Enter a domain name (e.g., github.com) in the input field. Click "Lookup" to query Certificate Transparency logs via crt.sh. Review the SSL health grade (A-F), expiry date, and issuer details. Check for issues like expired or soon-to-expire certificates. Queries Certificate Transparency logs through a same-origin endpoint so browser CORS does not block the lookup. The endpoint validates the domain before contacting crt.sh.