TLS certificate check
Connects to the domain on port 443 with SNI, verifies the certificate against the system's trusted roots and the host name (RFC 9525), and reports dates, names, issuer, chain, key and signature algorithm and the negotiated TLS version. No HTTP is sent.
Updated 2026-10-26
What this tool checks
The check connects to the domain on port 443, the same way a browser or an API client does, and reads the certificate the server presents:
- Trust: does the certificate chain lead to a certificate authority in the system's trusted root store? A self-signed certificate, an unknown issuer or a chain without its intermediate certificates gives
TLS_UNTRUSTEDwith the reason. - Name: is the domain one of the DNS names in the certificate's subject alternative names? Only those names count; the common name is not used (
TLS_HOSTNAME_MISMATCH). - Dates: when the certificate became valid and when it expires, with the days that remain. An expired certificate is
TLS_CERT_EXPIRED; less than 14 days left isTLS_CERT_EXPIRING_SOON, and 14 to 30 days isTLS_CERT_EXPIRING. - Strength: the key type and size, and the signature algorithm. RSA keys below 2048 bits and elliptic curve keys below 256 bits are
TLS_WEAK_KEY; SHA-1 or MD5 signatures areTLS_WEAK_SIGNATURE. - Connection: the negotiated TLS version and cipher, and whether the connection went over IPv4 or IPv6.
When no TLS connection is possible at all, the result is TLS_UNAVAILABLE, and the reason says whether the name has no address, the connection was refused or timed out, or the handshake failed.
How to read the result
Expiry, a wrong name and an untrusted chain are errors, because clients refuse the connection. The other findings are warnings or information about certificates that still work. The chain table lists each certificate from the server's own up to the root, with its subject and issuer.
The check reads only port 443. A CAA record check shows which certificate authorities may issue certificates for the domain at all.
Limitations
- Only TLS 1.2 and newer are used, so a server that offers nothing newer than TLS 1.1 shows as unavailable.
- Revocation (OCSP and CRL) and Certificate Transparency logs are not checked, and neither are the cipher suites the server would accept.
- The check uses the addresses public DNS gives for the domain and tries at most two of them; a server behind other addresses is not seen.
Use it from code
API reference for TLS certificate check
curl -i "https://api.lookproof.dev/v1/tls/certificate?domain=example.com"A request without payment is answered with 402 Payment Required and the exact price. See the API reference.
Limits
| Input | Domain |
|---|---|
| Deadline | 10 seconds |
| Freshness | Up to 5 minutes, never longer than the record TTL |
| Price | $0.01 per check |
Findings this tool can report
TLS certificate (8)
- Error
TLS_CERT_EXPIREDThe TLS certificate has expired. - Info
TLS_CERT_EXPIRINGThe TLS certificate expires within 30 days. - Warning
TLS_CERT_EXPIRING_SOONThe TLS certificate expires in less than 14 days. - Error
TLS_HOSTNAME_MISMATCHThe TLS certificate is not valid for the domain name. - Error
TLS_UNAVAILABLENo TLS connection to the domain on port 443 could be made. - Error
TLS_UNTRUSTEDThe TLS certificate does not chain to a trusted certificate authority. - Warning
TLS_WEAK_KEYThe TLS certificate uses a weak public key. - Warning
TLS_WEAK_SIGNATUREA certificate in the chain is signed with SHA-1 or MD5.
Frequently asked questions
Why does my certificate work in the browser but fail here?
Usually a missing intermediate certificate. Browsers often repair the chain themselves, because they cache intermediates or download them from the address in the certificate. Many API clients, mail servers and command-line tools do not. The check verifies like a strict client, so it reports TLS_UNTRUSTED until the server sends the full chain.
Does a wildcard certificate cover the bare domain?
No. *.example.com covers www.example.com and shop.example.com, but not example.com itself and not a.b.example.com. RFC 9525 lets a wildcard stand for exactly one whole label. Certificates for both usually list example.com and *.example.com as two names.
How early should a certificate be renewed?
Automated certificate authorities such as Let's Encrypt are renewed about a month before expiry, and the CA/Browser Forum is shortening the maximum lifetime step by step, so automation matters more every year. The check gives information from 30 days before expiry and a warning from 14 days, when a failed renewal is the likely reason.
Does the check send anything to my web server?
Only a TLS handshake on port 443, with the domain as the server name (SNI). No HTTP request is sent. If verification fails, the check makes one more handshake without verification so it can show the certificate's details.