{"uid":"cap_GOlFZD4rp0OH3JcIYTCky","slug":"2s-io-tls-certificate-inspector-0425e104","name":"2s.io TLS Certificate Inspector","description":"Open a live TLS connection to a host and return its certificate. Give a host (and optional port, default 443). Returns the negotiated TLS protocol + cipher, whether the chain validates against system roots, and the leaf certificate's subject + issuer (CN/O/C), validity window (valid-from / valid-to), days until expiry + expired flag, serial number, SHA-256 fingerprint, Subject Alternative Names, and the chain length. A genuine network probe agents can't do from their sandbox — for cert-expiry monitoring, TLS audits, and verifying who issued a site's certificate. SSRF-guarded: the host must resolve to a public address. Self-signed and expired certs are reported (not rejected).","url":"https://2s.io/api/tls/cert-info","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"required":["host"],"properties":{"host":{"type":"string","description":"Hostname or IP to probe."},"port":{"type":"integer","default":443,"maximum":65535,"minimum":1}}}}}}},"responseSchema":null,"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"host":"google.com","port":443}}},"response":{"data":{"ok":true,"items":[{"host":"google.com","port":443,"cipher":{"name":"TLS_AES_256_GCM_SHA384","version":"TLSv1.3"},"protocol":"TLSv1.3","authorized":true,"resolvedIp":"172.253.63.138","certificate":{"isCa":false,"issuer":{"raw":{"C":"US","O":"Google Trust Services","CN":"WR2"},"country":"US","commonName":"WR2","organization":"Google Trust Services"},"expired":false,"subject":{"raw":{"CN":"*.google.com"},"country":null,"commonName":"*.google.com","organization":null},"validTo":"2026-08-17T08:36:18.000Z","validFrom":"2026-05-25T08:36:19.000Z","serialNumber":"139CDF29A8B5BC5212413EEEAFD18CBE","daysUntilExpiry":60,"subjectAltNames":["*.google.com","*.appengine.google.com","*.bdn.dev","*.origin-test.bdn.dev","*.cloud.google.com","*.crowdsource.google.com","*.datacompute.google.com","*.google.ca","*.google.cl","*.google.co.in","*.google.co.jp","*.google.co.uk","*.google.com.ar","*.google.com.au","*.google.com.br","*.google.com.co","*.google.com.mx","*.google.com.tr","*.google.com.vn","*.google.de","*.google.es","*.google.fr","*.google.hu","*.google.it","*.google.nl","*.google.pl","*.google.pt","*.gemini.cloud.google.com","*.gstatic.com","*.metric.gstatic.com","*.gvt1.com","*.gcpcdn.gvt1.com","*.gvt2.com","*.gcp.gvt2.com","*.url.google.com","*.youtube-nocookie.com","*.ytimg.com","ai.android","android.com","*.android.com","*.flash.android.com","g.co","*.g.co","goo.gl","www.goo.gl","google-analytics.com","*.google-analytics.com","google.com","googlecommerce.com","*.googlecommerce.com","urchin.com","*.urchin.com","youtu.be","youtube.com","*.youtube.com","music.youtube.com","*.music.youtube.com","youtubeeducation.com","*.youtubeeducation.com","youtubekids.com","*.youtubekids.com","yt.be","*.yt.be","android.clients.google.com","*.aistudio.google.com"],"fingerprintSha256":"E4:13:4C:BC:32:C0:C0:97:65:99:C6:84:AE:0B:6A:C8:49:B2:D7:55:46:D9:34:DF:DB:61:1F:A0:D9:A0:E9:CB"},"chainLength":3,"authorizationError":null}],"total":1,"source":{"url":"https://2s.io","license":"No upstream license — computed by 2s.io","provider":"Live TLS handshake (node:tls)"}},"meta":{"cost":{"usd":0.001,"tier":0},"caller":"x402","version":null,"endpoint":"tls.cert-info","settlement":{"txHash":"0xa0ccda045ee276ef10cfd1fe49e9770027c65e16da44da2eb978e18ba1d6092b","network":"eip155:8453","success":true}}}},"exampleRequest":{"host":"google.com","port":443},"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0025","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0025","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_TXwiqUoD9GgI3el2XhdVK","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0025","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Opens a live TLS connection to any public host and returns full certificate details including expiry, chain validation, SANs, fingerprint, and negotiated protocol/cipher.","exampleAgentPrompt":"Check the TLS certificate for api.stripe.com — I want to know who issued it, when it expires, whether the chain is valid, and the SHA-256 fingerprint.","exampleUseCases":null,"resultDescription":"Returns the negotiated TLS protocol and cipher, chain validation status against system roots, leaf certificate subject and issuer (CN/O/C), validity window (valid-from and valid-to), days until expiry with an expired flag, serial number, SHA-256 fingerprint, Subject Alternative Names list, and chain length.","failureModes":["Host resolves to a private/reserved IP address — SSRF guard blocks the request","Host does not exist or DNS resolution fails — returns error with resolution failure detail","Connection refused or timeout on specified port — returns network error","Port out of range 1-65535 — input validation error"],"whenToPreferThis":"Use this endpoint when you need a real-time, live network probe of a TLS endpoint from outside an AI sandbox — especially for certificate expiry monitoring, TLS audit workflows, verifying certificate issuers, or checking SANs on a domain you don't control. Prefer this over static certificate databases when freshness and actual negotiation details (cipher, protocol) matter.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:53:46.040Z","isFirstParty":false}