TLS Certificate Lookup

Look up any domain's TLS certificate history straight from public Certificate Transparency logs via the certspotter API (api.certspotter.com) — issuer, validity window, and the full SAN (subject alternative name) list for every certificate ever logged for that domain. No API key, no scraping, no browser — this hits the public CT log search API directly.

Features

• Domain → certificate history. Every logged certificate for a domain, most recent first, with issuer, notBefore/notAfter validity dates, and revocation status.
• Full SAN visibility. Each certificate's subject alternative names (up to 25 per cert) — useful for discovering subdomains that were bundled into a single cert.
• Handles long-lived domains. Results are capped at the 50 most recent certificates per domain, with certificatesFound (total logged) and truncated flags so you know when more history exists.
• Pay only for hits. Domains with no logged certificates cost nothing — see Pricing.
• Built for bulk. Feed in thousands of domains; concurrency is configurable.

How to use TLS Certificate Lookup — Certificate Transparency API

1. In the Apify Console. Open the actor page and click Start — the items field is already pre-filled with a working example. Results land in the run's dataset as soon as each item is found.
2. Via the API. Call it directly with a POST request — no Console needed once you have an API token:

   curl "https://api.apify.com/v2/acts/accountable_eel~tls-certificate-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{"items":["stripe.com"]}'
   

3. On a schedule. Save this actor as an Apify Task with the input you want, then add a Schedule (hourly, daily, weekly) so it runs on its own — no server of your own required.

Input

{
  "items": ["example.com", "https://www.example.com/", "sub.example.org"],
  "maxConcurrency": 5
}

items is a list of domains or URLs to look up. Each entry is normalized before the lookup: the scheme (http:///https://), any path, and a leading www. are stripped, so https://www.example.com/path and example.com resolve the same way. maxConcurrency caps parallel requests (default 5, max 20) — this target has no browser fallback, so keeping it conservative avoids getting rate-limited. An optional proxyConfiguration lets you route through Apify Proxy (residential recommended for anti-bot-sensitive targets), though certspotter's public API is generally lenient.

Output

One row per input domain, for example:

{
  "query": "example.com",
  "found": true,
  "data": {
    "domain": "example.com",
    "certificatesFound": 187,
    "returned": 50,
    "truncated": true,
    "certificates": [
      {
        "id": "1234567890",
        "issuer": "R11",
        "notBefore": "2026-06-01T00:00:00Z",
        "notAfter": "2026-08-30T23:59:59Z",
        "sanCount": 3,
        "sans": ["example.com", "www.example.com", "mail.example.com"],
        "revoked": false
      }
    ]
  },
  "scrapedAt": "2026-08-21T12:00:00.000Z"
}

Domains with zero logged certificates come back as

{ "query": ..., "found": false, "scrapedAt": ... }

Use cases

• Attack surface discovery. Pull SANs across a domain's certificate history to surface subdomains that were bundled into shared certs.
• Certificate expiry monitoring. Check notAfter on the most recent cert for a fleet of domains before they lapse.
• Vendor/M&A due diligence. See how long a domain has been issuing certificates and which CAs it uses, without touching the target server directly.
• Security research. Investigate certificate issuance patterns (issuer changes, short-lived certs, revocations) for a set of domains.

Pricing

$5 per 1,000 results, plus a $0.005 start fee. Misses (found:false) are never charged.

Use it from Clay, n8n, Make, or an AI agent

This actor runs synchronously over plain HTTP — call it directly from a script, a workflow tool, or an AI agent, no Apify Console needed once you have an API token.

curl "https://api.apify.com/v2/acts/accountable_eel~tls-certificate-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"items":["stripe.com"]}'

n8n. Add an HTTP Request node: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~tls-certificate-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body Content Type JSON, JSON Body {"items":["stripe.com"]} (swap in an expression from an earlier node for a real value).

Clay. Add an "HTTP API" column: Method POST, URL https://api.apify.com/v2/acts/accountable_eel~tls-certificate-lookup/run-sync-get-dataset-items?token=<YOUR_TOKEN>, Body {"items":["{{value}}"]}, mapping the row's value into the items array.

MCP. In Claude, Cursor, or any MCP client with the Apify MCP server, ask for "TLS Certificate Lookup | Apify" — the agent will find and run this actor.

FAQ

Does this need an API key? No. It calls certspotter's public Certificate Transparency log search API, which requires no authentication for this use.

What counts as "found"? Any domain with at least one certificate logged in public CT logs. A domain with zero logged certificates (e.g. one that has never used a CA-issued/CT-logged cert) returns found: false and is not charged.

Can I pass a full URL instead of a bare domain? Yes — https://www.example.com/some/path is normalized down to example.com before the lookup (scheme, path, and www. prefix are stripped).

What if a domain has thousands of historical certificates? Output is capped at the 50 most recent (sorted by notBefore, newest first). Check certificatesFound vs. returned/truncated to see if history was cut off.

Does it use a proxy? Apify Proxy is enabled by default via proxyConfiguration, and you can switch to residential proxy for extra reliability, though certspotter's public API is generally tolerant of direct datacenter requests.

Why is maxConcurrency capped at 20? This target is a plain HTTP API lookup with no browser fallback — getting rate-limited or blocked costs more in retries than a conservative concurrency setting does in time.