Domains, Certificate Transparency and DNS, the moment it's issued.
Check the SSL certificate, issuer, expiry date and hosting IP for any domain we have seen in a Certificate Transparency log. That is the same record the API returns. You also get when the domain itself was registered and when it expires, its live DNS records, the network, organization and location behind its address, and every address it has resolved to.
Look up any domain's SSL certificate, issuer and expiry from the public Certificate Transparency logs. You also get the IP address it resolves to, the network and organization that address belongs to, and its current DNS records. One HTTP call, JSON to a script and a page to a browser.
We read the public CT logs continuously, and ingest the ICANN zone file feeds for newly registered domains. Two streams come in: certificates as they are logged, and domains as they are registered. We join and enrich them and keep the history, so each domain ends up with one record and a trail of what changed to get there. Domain lookups are free and need no key or sign-up; the reverse-IP and newly-registered feeds use one.
$ curl issued.live/tuxxin.com { "domain": "tuxxin.com", "registered": "2011-04-27T06:24:46Z", "expires": "2027-04-27T06:24:46Z", "ssl_expires": "2026-11-28T10:58:19Z", "ssl_cert": "431095AFAB96BC5C282ED931FC907068", "ssl_issuer": "Google Trust Services", "ip": "188.114.96.0", "last_update": "2026-09-15T22:19:14Z", "first_cert_seen": null, "tracked": false }
A real response from the running API, refreshed with the page:
every key it returns, in the order it returns them. ip comes from our own resolvers.
We populate registered and expires only where we hold
registration data; until then they are null, and we never guess them.
From the logs: what we have observed
From resolution: what we have established
A thousand lookups a day need no key. Beyond that, or for the reverse-IP endpoints, a key is free, so ask.
