{"uid":"cap_S1g5T5-BdHFbB48ejh7Gy","slug":"ssl-tls-certificate-check-cd25a77f","name":"SSL/TLS Certificate Check","description":"SSL/TLS certificate check: expiry, issuer, SANs, chain validity, hostname match, negotiated protocol/cipher, and weak-algo warnings for a public HTTPS host. Clean JSON.","url":"https://ssl.use.x402atlas.com/check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["host"],"properties":{"host":{"type":"string","description":"Hostname to inspect (no scheme, no IP literal, not localhost or a reserved/internal suffix)"},"port":{"enum":[443,8443],"type":"integer","default":443,"description":"TLS port; restricted to an allowlist"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"host":{"type":"string"},"port":{"type":"integer"},"chain":{"type":"object","properties":{"is_expired":{"type":"boolean"},"chain_valid":{"type":"boolean","description":"Verified against the system trust store using only the intermediates the server presented; no AIA fetching"},"is_self_signed":{"type":"boolean"},"hostname_matches":{"type":"boolean"},"days_until_expiry":{"type":"integer"}}},"warnings":{"type":"array","items":{"type":"string"},"description":"Human-readable advisories (weak algo, expired, self-signed, chain invalid, hostname mismatch); empty array when clean"},"connection":{"type":"object","properties":{"tls_version":{"type":"string"},"cipher_suite":{"type":"string"}}},"queried_at":{"type":"string","format":"date-time","description":"When the inspection ran"},"certificate":{"type":"object","properties":{"sans":{"type":"array","items":{"type":"string"},"description":"Subject Alternative Names"},"key_size":{"type":"integer","description":"Key size in bits (0 for algorithms with no fixed size, e.g. Ed25519)"},"issuer_cn":{"type":"string"},"not_after":{"type":"string","format":"date-time"},"issuer_org":{"type":"string"},"not_before":{"type":"string","format":"date-time"},"subject_cn":{"type":"string"},"key_algorithm":{"type":"string","description":"e.g. RSA, ECDSA, Ed25519"},"serial_number":{"type":"string"},"signature_algorithm":{"type":"string"}}}}}}}}},"responseSchema":{"type":"json","example":{"host":"example.com","port":443,"chain":{"is_expired":false,"chain_valid":true,"is_self_signed":false,"hostname_matches":true,"days_until_expiry":228},"warnings":[],"connection":{"tls_version":"TLS 1.3","cipher_suite":"TLS_AES_128_GCM_SHA256"},"queried_at":"2026-07-02T12:00:00Z","certificate":{"sans":["example.com","www.example.com"],"key_size":256,"issuer_cn":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","not_after":"2027-02-15T23:59:59Z","issuer_org":"DigiCert Inc","not_before":"2026-01-15T00:00:00Z","subject_cn":"example.com","key_algorithm":"ECDSA","serial_number":"212351572002930070173044758915925313","signature_algorithm":"ECDSA-SHA384"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_W0HJC_NZdd5X3Cwr9CpHl","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Inspects an HTTPS host's TLS certificate and connection, returning expiry, issuer, SANs, chain validity, hostname match, negotiated protocol/cipher, and weak-algorithm warnings as clean JSON.","exampleAgentPrompt":"Check the SSL certificate for api.example.com — I want to know if it's expiring soon, who issued it, whether the chain is valid, and if there are any weak-algorithm warnings.","exampleUseCases":[{"title":"Pre-deployment certificate audit","prompt":"Before we go live, check the SSL cert for staging.myapp.io — I need to confirm the chain is valid, the hostname matches, and the cert isn't expiring within the next 30 days."},{"title":"Security alert triage for weak TLS","prompt":"I got an alert that payments.mystore.com might be using an outdated TLS version or a weak cipher — can you inspect the certificate and connection details and tell me what warnings come back?"},{"title":"Monitoring certificate expiry across domains","prompt":"Check the SSL certificate on newsletter.mybrand.com and tell me how many days are left before it expires and whether there are any chain or hostname issues I should know about."}],"resultDescription":"A JSON object containing: the queried hostname and port, the certificate's subject CN, issuer CN and org, validity window (not_before/not_after), days until expiry, Subject Alternative Names, key algorithm and size; chain-level booleans (is_expired, chain_valid, is_self_signed, hostname_matches, days_until_expiry); the negotiated TLS version and cipher suite; a timestamp of when the inspection ran; and a warnings array of human-readable advisories (e.g. weak algorithm, expired, self-signed, chain invalid, hostname mismatch) — empty when everything is clean.","failureModes":["Host resolves to a private/reserved IP or localhost — rejected by the service","Port not in the allowed list (only 443 and 8443 are permitted)","Host is unreachable or times out during TLS handshake — connection error returned","Server presents no certificate or handshake fails — TLS negotiation error","Invalid hostname format (IP literal or malformed string) — validation error"],"whenToPreferThis":"Use this endpoint when you need a quick, structured TLS/certificate inspection for a public HTTPS host without setting up your own OpenSSL tooling. It is ideal for automated monitoring pipelines, CI/CD pre-deployment checks, or ad-hoc security audits where you need expiry countdowns, chain validity, hostname matching, and weak-cipher warnings in a single clean JSON response. Prefer it over generic HTTP-check endpoints when certificate-level detail (issuer, SANs, key algorithm) is required.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:34:14.735Z","isFirstParty":false,"canonicalSlug":"ssl-tls-certificate-check-cd25a77f"}