SSL Certificate Checker API

Check the SSL/TLS certificate of any domain: days to expiry, issuer, SANs, hostname match, chain, OCSP stapling, TLS version, cipher and old protocols.

Parameters

Example

curl "https://apibox.io.vn/v1/ssl-check?host=github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/ssl-check?host=github.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/ssl-check?host=github.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/ssl-check?host=github.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "host": "github.com",
  "port": 443,
  "sni": "github.com",
  "addresses": [
    "20.205.243.166"
  ],
  "source": "live_handshake",
  "tls": {
    "version": "TLS 1.3",
    "cipher": "TLS_AES_128_GCM_SHA256",
    "key_exchange_group": "x25519",
    "alpn": "h2",
    "handshake_ms": 162,
    "ocsp_stapling": {
      "stapled": false
    }
  },
  "protocols": {
    "TLS 1.0": false,
    "TLS 1.1": false,
    "TLS 1.2": true,
    "TLS 1.3": true
  },
  "summary": {
    "observed": true,
    "valid": true,
    "hostname_match": true,
    "matched_name": "DNS:github.com",
    "days_remaining": 77,
    "expires_at": "2027-01-27T23:59:59Z",
    "issuer": "Sectigo Limited",
    "validation_level": "DV",
    "chain_length": 3,
    "chain_complete": null,
    "chain_issuer_checked": null
  },
  "certificate": {
    "subject": "CN=github.com",
    "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
    "serial_number": "3E:1D:60:26:B4:B0:AE:A2:79:DC:A2:EF:BB:CE:D8:2B",
    "version": 3,
    "not_before": "2026-10-30T00:00:00Z",
    "not_after": "2027-01-27T23:59:59Z",
    "days_remaining": 77,
    "valid_now": true,
    "validity_days": 90,
    "san": {
      "dns": [
        "github.com",
        "www.github.com"
      ],
      "ip": [],
      "email": [],
      "uri": []
    },
    "public_key": {
      "algorithm": "EC",
      "curve": "P-256",
      "size": 256
    },
    "signature_algorithm": "ecdsa-with-SHA256",
    "is_ca": false,
    "self_signed": false,
    "validation_level": "DV",
    "extensions": {
      "key_usage": [
        "digitalSignature"
      ],
      "extended_key_usage": [
        "serverAuth"
      ],
      "ocsp_urls": [
        "http://ocsp.sectigo.com"
      ],
      "ca_issuer_urls": [
        "http://crt.sectigo.com/SectigoPublicServerAuthenticationCADVE36.crt"
      ],
      "sct_present": true
    },
    "fingerprints": {
      "sha256": "7D:C4:D8:5C:F1:E3:10:97:12:25:BC:9A:92:57:67:90:43:A2:43:D7:0A:3C:C2:A9:1C:C5:D3:89:89:2C:27:76",
      "sha1": "E6:52:C8:BD:1C:AF:D0:4A:44:23:9F:A8:DA:B0:C5:9D:EA:CB:79:EE"
    }
  },
  "chain": [
    {
      "index": 0,
      "subject": "CN=github.com",
      "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
      "not_after": "2027-01-27T23:59:59Z",
      "days_remaining": 77,
      "signature_algorithm": "ecdsa-with-SHA256",
      "is_ca": false,
      "self_signed": false,
      "signed_by_next": true
    },
    {
      "index": 1,
      "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
      "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46",
      "not_after": "2036-03-21T23:59:59Z",
      "days_remaining": 3418,
      "signature_algorithm": "ecdsa-with-SHA384",
      "is_ca": true,
      "self_signed": false,
      "signed_by_next": true
    },
    {
      "index": 2,
      "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46",
      "issuer": "C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust ECC Certification Authority",
      "not_after": "2038-01-18T23:59:59Z",
      "days_remaining": 4086,
      "signature_algorithm": "ecdsa-with-SHA384",
      "is_ca": true,
      "self_signed": false,
      "signed_by_next": null
    }
  ],
  "https_request": {
    "url": "https://github.com/",
    "ok": true,
    "status": 200,
    "ms": 177,
    "error": null,
    "hsts": "max-age=31536000; includeSubdomains; preload"
  },
  "warnings": [],
  "note": "Observed live: the certificates the server presented in a TLS handshake from our edge. …"
}

Use cases

• Get warned before a certificate expires on a client site
• Check that a new certificate is installed with its full chain
• Audit servers that still accept TLS 1.0 / 1.1
• Check the certificates of 10 domains in one call from a cron job

FAQ

Related APIs