{"uid":"cap_5-gDj-YzUZZKb0JeCUgEp","slug":"mekler-ai-tls-certificate-inspector-ca597507","name":"Mekler AI TLS Certificate Inspector","description":"Inspect a public host on TCP port 443 for certificate expiry, DNS names, fingerprint, runtime CA/hostname validation and negotiated TLS details. A failed certificate check triggers one unverified diagnostic handshake and remains untrusted. No HTTP scanning, revocation or exhaustive security assessment.","url":"https://api.mekler.ai/v1/web/tls/inspect-certificate?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"hostname":{"type":"string","maxLength":253},"request_id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,64}$"}}},"responseSchema":{"type":"json","example":{"port":443,"cipher":"TLS_AES_256_GCM_SHA384","sha256":"0000000000000000000000000000000000000000000000000000000000000000","status":"ok","hostname":"mekler.ai","verified":true,"dns_names":["mekler.ai"],"not_after":"2027-01-01T00:00:00+00:00","not_before":"2026-10-01T00:00:00+00:00","time_valid":true,"limitations":["One remote handshake from the deployed service; DNS, certificate and routing can change.","verified uses the runtime CA store and hostname validation. Certificate failure triggers one unverified handshake to collect diagnostics; it does not make the certificate trusted.","No revocation/OCSP, certificate-transparency, exhaustive protocol/cipher scan or overall security guarantee. Only public DNS hosts on port 443; no HTTP request is sent."],"observed_at":"2026-10-20T00:00:00Z","tls_version":"TLSv1.3","seconds_until_expiry":6307200,"verification_error_code":null}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_TKexZcADgBhPgvcUiOqdX","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Inspects a public host on TCP port 443 for TLS certificate validity, expiry, DNS names, fingerprint, and negotiated cipher/version details","exampleAgentPrompt":"Can you inspect the TLS certificate for api.example.com — I need to know if it's currently valid, when it expires, what cipher and TLS version are being used, and whether it passes hostname verification?","exampleUseCases":[{"title":"Pre-deployment certificate health check","prompt":"Before we push to production, can you check the TLS certificate on staging.myapp.io — confirm it's valid, trusted, and won't expire in the next 30 days?"},{"title":"Monitoring expiry for a critical domain","prompt":"Check the TLS certificate for payments.acme.com and tell me exactly how many seconds until it expires and whether it currently passes hostname verification."},{"title":"Investigating a TLS handshake failure","prompt":"Our users are getting SSL errors on checkout.storefront.com — can you inspect its certificate and tell me the verification error code, DNS names, and whether it's actually trusted by the runtime CA store?"}],"resultDescription":"Returns a JSON object containing: port (443), negotiated cipher suite, SHA-256 certificate fingerprint, overall status, hostname, verified boolean, DNS SANs array, not_before and not_after timestamps, time_valid boolean, seconds_until_expiry, observed_at timestamp, TLS version, verification_error_code (if any), and a limitations array describing scope constraints of the check.","failureModes":["Hostname does not resolve in public DNS — no handshake possible","Host unreachable or connection refused on port 443 — timeout or connection error","Certificate fails verification — triggers one additional unverified diagnostic handshake; certificate remains untrusted and verification_error_code is populated","Invalid hostname format exceeding 253 characters — input validation error","Host is not a public DNS host (private IP or internal name) — not supported","Service-side network issues may cause transient failures"],"whenToPreferThis":"Choose this endpoint when you need a quick, structured TLS certificate inspection for a public hostname — specifically to check expiry, verify trust, retrieve DNS SANs, fingerprint, and negotiated TLS version/cipher — without needing HTTP scanning, OCSP revocation checking, or a full security audit. It is ideal for automated certificate monitoring, pre-deployment checks, and lightweight TLS diagnostics in agentic workflows where cost and latency matter.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T13:08:27.728Z","isFirstParty":false,"canonicalSlug":"mekler-ai-tls-certificate-inspector-ca597507"}