SSL Inspector

API key v1

Certificate, chain, expiry and TLS details for any host.

Opens a TLS connection with SNI, captures the certificate chain and reports subject, issuer, alternative names, validity window, days remaining, key type and size, signature algorithm, negotiated protocol and cipher, hostname match and whether the chain verifies against the public CA store.

GET https://api.zactonz.com/domain/ssl/

Parameters

Name	Type	Description
`host`required	string	Host name, or a URL from which the host is taken.
`port`	enum	TLS port: 443, 8443, 465, 993, 995, 636 or 5061. `44384434659939956365061`
`fresh`	boolean	`1` bypasses the cache. Default

Send parameters in the query string.

Response

Field	Type	Description
`status`	integer	`200` on success.
`data`	object	The result.
`data.host`	string	Host inspected.
`data.ip`	string	Address connected to.
`data.port`	integer	Port.
`data.connect_ms`	integer	Handshake time in milliseconds.
`data.protocol`	string	Negotiated protocol, for example `TLSv1.3`.
`data.cipher`	string	Negotiated cipher.
`data.valid`	boolean	True when the chain is trusted, the name matches and the certificate is within its dates.
`data.hostname_match`	boolean	Whether the certificate covers `host`.
`data.trusted_chain`	boolean	Whether the chain verifies against the CA store.
`data.chain_error`	string	Verification error when the chain fails.
`data.expired`	boolean	Whether the certificate has expired.
`data.not_yet_valid`	boolean	Whether the certificate is not yet valid.
`data.self_signed`	boolean	Whether issuer equals subject.
`data.days_remaining`	integer	Days until expiry, negative when expired.
`data.certificate`	object	Leaf certificate: `subject`, `issuer`, `san`, `serial`, `signature_algorithm`, `key_type`, `key_bits`, `not_before_iso`, `not_after_iso`, `fingerprint_sha256`.
`data.chain`	array of object	Every certificate the server sent, in the same shape.

Status codes

The outcome is reported in the JSON status field. See Errors & status codes for the general rules.

`400`	Bad request	`host` is missing, not a host name, on a disallowed port, or not reachable from here.
`422`	No TLS	The host did not complete a TLS handshake or presented no certificate.
`401`	Unauthorized	The Authorization header is missing or the key is not recognised.
`403`	Forbidden	The key is not licensed for this product.
`429`	Too many requests	The per-minute rate or the plan quota is exhausted. Retry after the seconds given in `Retry-After`.

Notes

Results are cached for ten minutes unless fresh=1. Hosts that resolve to private addresses are refused.