FreeTools logo TLS Check

Use the form above. Parameters, code examples and FAQ are grouped in the documentation section below.

Description
- Negotiated TLS version, cipher suite and certificate expiry for any public domain.
- Catches expired certificates before your users do. Internal hosts are blocked.
- Note: this tool displays certificate data (including expired or self-signed certs) but does not validate the chain of trust — a shown certificate is not necessarily trusted.
- Only supports GET request.
- Limit : 30 requests per minute. Once reached subsequent requests will result in error 429 (too many requests) until your quota is cleared.
Endpoint - Check TLS certificate
HTTP Request:
GET /v1/tls?domain=example.com
Optional port (default 443).
Examples
/v1/tls?domain=example.com
/v1/tls?domain=expired.badssl.com
response 
{
  "domain": "example.com",
  "port": 443,
  "tls_version": "TLSv1.3",
  "cipher": "TLS_AES_256_GCM_SHA384",
  "cert_subject": "CN=example.com",
  "cert_issuer": "C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3",
  "not_before": "2026-07-29T22:10:08Z",
  "not_after": "2026-10-27T22:17:21Z",
  "days_left": 34,
  "expired": false
}
Try it live

    

  


  


  
  

  
Related tools

  

  

  Documentation & API reference
  

  
How to use the TLS & Certificate Checker

  
Inspect a domain's TLS version, cipher suite, certificate chain, SANs and expiry date without OpenSSL.

  
Endpoints

  
EndpointReturnsExample

  
/v1/tlsJSONdomain=example.com

  

  
Parameters

  
NameTypeDefaultDescription

  
domainstringrequiredHostname to check. A full URL is accepted and trimmed down to the host.

  
portinteger443Port to connect to, 1-65535. Useful for non-standard HTTPS ports.

  

  
Code examples

  

  
curl 'https://freetools.one/v1/tls?domain=example.com'

  
const t = await (await fetch('https://freetools.one/v1/tls?domain=example.com')).json();
console.log(t.tls_version, t.cipher_strength, t.days_left + ' days left');

  
import requests

t = requests.get('https://freetools.one/v1/tls', params={'domain': 'example.com'}).json()
print(t['tls_version'], t['cipher_strength'], t['days_left'], 'days left')

  
Example response

  
{
  "domain": "example.com",
  "port": 443,
  "tls_version": "TLSv1.3",
  "cipher": "TLS_AES_256_GCM_SHA384",
  "cipher_strength": "strong",
  "cert_issuer": "C=US, O=Let's Encrypt, CN=R11",
  "san": ["example.com", "www.example.com"],
  "days_left": 89,
  "expired": false
}

  
Frequently asked questions

  

  
How do I check when a TLS certificate expires?
Call /v1/tls?domain=example.com and read the days_left and not_after fields. The checker performs a real handshake, so it reports the certificate the server actually presents.

  
Does the TLS checker support non-standard ports?
Yes. Pass port=8443 (or any port from 1 to 65535) and the probe connects there instead of 443.

  
Is a weak cipher flagged automatically?
Yes. Each negotiated cipher is rated strong, good, moderate, legacy or weak, so outdated suites are easy to spot in monitoring.

  
Do I need to install OpenSSL?
No. The TLS handshake and certificate parsing happen inside the API, so it works from any platform with plain HTTPS.