{"uid":"cap_VX_PigJf6kjWxOCxpyAdT","slug":"fetchx402-ssl-certificate-inspector-5e8db1d2","name":"fetchx402 SSL Certificate Inspector","description":"Inspect the leaf TLS certificate for a public hostname (validity, issuer, SANs, fingerprint, expiry). Use when you need live cert facts and must not guess. Expired or hostname-mismatched certs still return JSON flags.","url":"https://api.fetchx402.com/v1/tools/ssl-check","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"headers":{"type":"object","additionalProperties":{"type":"string"}},"queryParams":{"type":"object","required":["domain"],"properties":{"port":{"enum":[443],"type":"integer","description":"TLS port. v1 accepts 443 only. Defaults to 443 if omitted."},"domain":{"type":"string","description":"Public fully-qualified domain name to inspect, such as example.com. IPs, localhost, and internal/mDNS names are rejected."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"sni":"example.com","port":443,"sans":["www.example.org","example.com","example.net","example.org"],"cipher":"aes_256_gcm_sha384","domain":"example.com","issuer":"CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1, O=DigiCert Inc, C=US","serial":"0f1a2b3c4d5e6f708192a3b4c5d6e7f8","expired":false,"peer_ip":"23.215.0.138","subject":"CN=www.example.org, O=Internet Corporation for Assigned Names and Numbers, C=US","not_after":"2027-01-15T23:59:59Z","not_before":"2026-01-15T00:00:00Z","tls_version":"tlsv1.3","not_yet_valid":false,"hostname_match":true,"fingerprint_sha256":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","signature_algorithm":"ecdsa-with-SHA384"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_zmfuBGm170MvUHJMoEXvC","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches and inspects the live TLS/SSL certificate for a public hostname, returning validity, issuer, SANs, fingerprint, and expiry status as structured JSON.","exampleAgentPrompt":"Can you check the SSL certificate for api.example.com and tell me whether it's valid, when it expires, who issued it, and what domains it covers?","exampleUseCases":[{"title":"Pre-deployment certificate audit","prompt":"Before I launch, can you inspect the TLS certificate on staging.myapp.io and confirm it's valid, not expired, and actually covers that hostname?"},{"title":"Monitoring expiring certificates","prompt":"Check the SSL cert for payments.acmecorp.com — I want to know the expiry date and whether it's still valid so I can decide if we need to renew soon."},{"title":"Third-party vendor security check","prompt":"I need to verify that api.thirdpartyvendor.com has a legitimate TLS certificate — can you pull the live cert details and tell me the issuer, fingerprint, and whether there are any hostname mismatches?"}],"resultDescription":"A JSON object containing the certificate's validity status (boolean), expiry date and days remaining, issuer details (organization, common name), Subject Alternative Names (SANs) covered by the cert, SHA fingerprint, and boolean flags for hostname mismatch and expiration — even if the cert is expired or mismatched.","failureModes":["Domain is an IP address, localhost, or internal/mDNS name — rejected with an error","Domain does not exist or DNS resolution fails","No TLS listener on port 443 — connection refused or timeout","Certificate chain cannot be retrieved — partial or empty result","Invalid domain format in query parameter — validation error"],"whenToPreferThis":"Use this endpoint when you need live, authoritative TLS certificate facts for a public domain and cannot rely on cached or guessed data. It is especially useful for security audits, pre-deployment checks, and monitoring expiry — and uniquely returns structured JSON flags even for expired or hostname-mismatched certificates, making it safe for automated pass/fail logic.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:31:13.057Z","isFirstParty":false}