Popular tools

Theme

GET/api/v2/ssl

SSL checker API

Check a server's TLS certificate, chain, trust in four root stores, revocation, protocols and ciphers, and grade it A+ to F.

GEThttps://dnsrobot.netBase URL/api/v2Version/sslEndpoint?host=&port=Parameters
200 OKRecorded 2026-10-25. Send it to run the request live.
{
  "query": {
    "host": "github.com",
    "port": 443
  },
  "service": "https",
  "starttls": null,
  "checkedAt": "2026-10-25T08:13:22.503Z",
  "ip": "140.82.114.4",
  "reach": "direct",
  "reachDetail": null,
  "state": "valid",
  "grade": {
    "letter": "A+",
    "ignoringTrust": null,
    "reasons": []
  },
  "certificate": {
    "subject": {
      "commonName": "github.com",
      "organization": null,
      "organizationalUnit": null,
      "locality": null,
      "state": null,
      "country": null,
      "dn": "CN=github.com"
    },
    "issuer": {
      "commonName": "Sectigo Public Server Authentication CA DV E36",
      "organization": "Sectigo Limited",
      "organizationalUnit": null,
      "locality": null,
      "state": null,
      "country": "GB",
      "dn": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36"
    },
    "ca": {
      "id": "sectigo",
      "name": "Sectigo"
    },
    "names": [
      "github.com",
      "www.github.com"
    ],
    "nameCount": 2,
    "ipAddresses": [],
    "notBefore": "2026-09-01T00:00:00.000Z",
    "notAfter": "2026-11-29T23:59:59.000Z",
    "daysLeft": 35,
    "lifetimeDays": 90,
    "maxLifetime": "200 days",
    "key": {
      "algorithm": "EC",
      "bits": 256,
      "curve": "P-256",
      "postQuantum": false
    },
    "signature": {
      "algorithm": "ecdsa-with-SHA256",
      "hash": "SHA-256"
    },
    "serial": "a59ebdb596751db7f5c095079613953c",
    "sha256": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63",
    "sha1": "d3b63e61c64fd29ba9b8729628f8697f556a341f",
    "spkiSha256": "/wiL5vgOLgwED41WS0DNF8QiTBVR/P41Kd163tmFxK0=",
    "validation": "DV",
    "selfSigned": false,
    "mustStaple": false,
    "precertificate": false,
    "source": "sent",
    "scts": [
      {
        "log": "Google Argon2026h2",
        "operator": "Google",
        "time": "2026-09-01T00:10:32.017Z",
        "source": "embedded"
      },
      {
        "log": "Sectigo Tiger2026h2",
        "operator": "Sectigo",
        "time": "2026-09-01T00:10:31.981Z",
        "source": "embedded"
      }
    ],
    "ocspUrls": [
      "http://ocsp.sectigo.com"
    ],
    "crlUrls": []
  },
  "hostname": {
    "matches": true,
    "matchedName": "github.com",
    "wildcard": false,
    "commonNameOnly": false
  },
  "chain": {
    "sent": [
      {
        "subject": "CN=github.com",
        "role": "leaf",
        "sha256": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63"
      },
      {
        "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
        "role": "intermediate",
        "sha256": "873f0ba80e3ac222656dfd04158cc15c2927d42d5d05f01dee4a47eb43a916df"
      },
      {
        "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46",
        "role": "intermediate",
        "sha256": "ea6b89ed6907a209ff9188676fb164e7aced894b8996dfbe5ce5bbcc22de4ddd"
      }
    ],
    "inOrder": true,
    "path": [
      {
        "commonName": "github.com",
        "subject": "CN=github.com",
        "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
        "notAfter": "2026-11-29T23:59:59.000Z",
        "keyAlgorithm": "EC",
        "keyBits": 256,
        "sha256": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63",
        "source": "sent"
      },
      {
        "commonName": "Sectigo Public Server Authentication CA DV E36",
        "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
        "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46",
        "notAfter": "2036-03-21T23:59:59.000Z",
        "keyAlgorithm": "EC",
        "keyBits": 256,
        "sha256": "873f0ba80e3ac222656dfd04158cc15c2927d42d5d05f01dee4a47eb43a916df",
        "source": "sent"
      }
    ],
    "root": {
      "name": "Sectigo Public Server Authentication Root E46",
      "owner": "Sectigo",
      "notAfter": "2046-03-21T23:59:59.000Z",
      "sha256": "c90f26f0fb1b4018b22227519b5ca2b53e2ca5b3be5cf18efe1bef47380c5383",
      "sent": true,
      "crossSignedBy": "USERTrust ECC Certification Authority"
    },
    "stores": {
      "mozilla": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "chrome": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "apple": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "microsoft": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": null,
        "ev": false
      }
    },
    "trustedAll": true,
    "trustedAny": true,
    "missingIntermediate": false,
    "caOwner": "Sectigo"
  },
  "revocation": {
    "status": "good",
    "method": "ocsp",
    "revokedAt": null,
    "reason": null,
    "stapled": false,
    "mustStapleViolated": false,
    "ocspUrl": "http://ocsp.sectigo.com",
    "crlUrl": null,
    "detail": null
  },
  "connection": {
    "protocol": "TLS 1.3",
    "cipher": "TLS_AES_128_GCM_SHA256",
    "group": "x25519",
    "alpn": "h2",
    "signatureScheme": "ecdsa_secp256r1_sha256",
    "ocspStapled": false,
    "connectMs": 207,
    "handshakeMs": 415
  },
  "protocols": {
    "ssl3": false,
    "tls10": false,
    "tls11": false,
    "tls12": true,
    "tls13": true
  },
  "ciphers": {
    "tls13": [
      "TLS_AES_128_GCM_SHA256",
      "TLS_AES_256_GCM_SHA384",
      "TLS_CHACHA20_POLY1305_SHA256"
    ],
    "tls12": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_RSA_WITH_AES_256_CBC_SHA256",
      "TLS_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
    ],
    "tls11": [],
    "tls10": [],
    "serverOrder": false,
    "capped": false
  },
  "groups": {
    "accepted": [
      "x25519",
      "secp256r1"
    ],
    "postQuantum": [],
    "prefersPostQuantum": null
  },
  "http": {
    "status": 200,
    "hsts": {
      "maxAge": 31536000,
      "includeSubDomains": true,
      "preload": true
    },
    "hstsInvalid": false,
    "redirectsToHttps": true,
    "http3": false,
    "server": "github.com",
    "preload": "preloaded",
    "preloadedBy": null
  },
  "dns": {
    "addresses": [
      "140.82.114.4"
    ],
    "cname": [],
    "caa": [
      {
        "flags": 0,
        "tag": "issue",
        "value": "letsencrypt.org"
      },
      {
        "flags": 0,
        "tag": "issuewild",
        "value": "letsencrypt.org"
      },
      {
        "flags": 0,
        "tag": "issuewild",
        "value": "digicert.com"
      },
      {
        "flags": 0,
        "tag": "issue",
        "value": "sectigo.com"
      },
      {
        "flags": 0,
        "tag": "issue",
        "value": "globalsign.com"
      },
      {
        "flags": 0,
        "tag": "issue",
        "value": "digicert.com"
      },
      {
        "flags": 0,
        "tag": "issuewild",
        "value": "sectigo.com"
      }
    ],
    "caaFrom": "github.com",
    "caaAllows": true,
    "httpsRecord": null,
    "dane": {
      "records": 0,
      "dnssec": false,
      "matches": null
    }
  },
  "ct": {
    "total": 11,
    "more": false,
    "cas": [
      "Sectigo",
      "Let's Encrypt"
    ],
    "renewalDays": 6,
    "servedIndex": 4,
    "recent": [
      {
        "sha256": "d0047fd64e27c628fdf51599b5495d13943770595ad4b8ce45730bb9e9ea3ef7",
        "issuer": "Sectigo",
        "notBefore": "2026-10-14T00:00:00Z",
        "notAfter": "2027-01-11T23:59:59Z",
        "lifetimeDays": 90,
        "names": 4,
        "covers": "exact"
      },
      {
        "sha256": "f948860125446a8878f709c82d7512ec1b4dfb85fe004aefe7ad33a03b645190",
        "issuer": "Sectigo",
        "notBefore": "2026-10-08T00:00:00Z",
        "notAfter": "2027-01-05T23:59:59Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "exact"
      },
      {
        "sha256": "d98af57e2f20997004dd087e2f0506c2638e9f8d1ff8af6995b317e749670b04",
        "issuer": "Sectigo",
        "notBefore": "2026-10-02T00:00:00Z",
        "notAfter": "2026-12-30T23:59:59Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "exact"
      },
      {
        "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
        "issuer": "Let's Encrypt",
        "notBefore": "2026-09-30T23:44:46Z",
        "notAfter": "2026-12-29T23:44:45Z",
        "lifetimeDays": 90,
        "names": 6,
        "covers": "exact"
      },
      {
        "sha256": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63",
        "issuer": "Sectigo",
        "notBefore": "2026-09-01T00:00:00Z",
        "notAfter": "2026-11-29T23:59:59Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "exact"
      }
    ]
  },
  "issues": [],
  "tookMs": 4877
}
Jump to a section

How it works

Speaks TLS to the server itself (from the first public IPv4 address of the name) and reads exactly what it sends: the certificate and chain as sent, the protocol, cipher and key exchange. The chain is then built and checked against the Mozilla, Chrome, Apple and Microsoft root stores, the name is matched by RFC 9525, revocation is asked of the CA (stapled OCSP, OCSP, then CRL), and a scan finds which protocol versions, cipher suites and key exchange groups the server still accepts. For HTTPS it also reads HSTS, the http → https redirect and the HSTS preload list; DNS adds CAA, the HTTPS record and DANE; Cert Spotter adds the name's Certificate Transparency history.

The grade follows Qualys SSL Labs' rating guide (caps, not points): T for an untrusted chain and M for a name mismatch come first, with ignoringTrust saying what the configuration would earn once fixed. Every problem is in issues with a stable code.

Mail and other services work on their usual ports (465, 587 with STARTTLS, 993, 995, 853…). Port 25 is refused: Cloudflare Workers can't open it.

Honest limits: names on Cloudflare's network refuse our servers' TLS connections, so for them the certificate comes from the CT log (the newest one issued, which may not be the one served), protocols aren't scanned and there is no grade; the answer then says incomplete with the warning cloudflare_no_handshake. IPv6-only servers can't be reached yet. A silent port is reported as no answer, never as closed. A full check takes 3 to 25 seconds.

Answers kept: A finished check is kept 10 minutes (1 minute when a part didn't finish or the server didn't answer), shared with the SSL Checker page; `checkedAt` says when it ran. Answers for names on Cloudflare's network aren't kept.

Query parameters

  • hoststringrequired
    A hostname (github.com), a URL (https://github.com/about, its port is used) or a public IPv4 address. IDNs in Unicode are accepted.
  • portintegeroptionaldefault 443
    The port, when not in host. The service follows from it: 443/8443 HTTPS, 465 SMTPS, 587 SMTP with STARTTLS, 993 IMAPS, 143 IMAP with STARTTLS, 995/110 POP3, 21/990 FTP, 853 DNS over TLS, 636 LDAPS; any other port is plain TLS.

Response fields

200 with this JSON object, plus tookMs, and incomplete with warnings when a source failed. Fields marked optional appear only when they apply.

  • queryobjectalways
    What was looked up, normalised (lower case, no trailing dot, IDNs as Punycode).
    • hoststringalways
      The host checked: lower case, no trailing dot, IDNs as Punycode; or an IPv4 address.
    • portintegeralways
      The port checked.
  • servicestringalways
    The service on the port (from the port number): TLS from the first byte, or after STARTTLS for smtp/imap/pop3/ftp on their plain ports.

    one of "https", "smtp", "imap", "pop3", "ftp", "dot", "ldap", "tls"

  • starttlsstring or nullalways
    The STARTTLS dialect used before the handshake, or null for implicit TLS.

    one of "smtp", "imap", "pop3", "ftp", null

  • checkedAtstringalways
    When the check ran (ISO 8601). Older than the request when the answer came from our 10-minute cache.
  • ipstring or nullalways
    The IPv4 address we connected to (the name's first public one).
  • reachstring or nullalways
    How far we got: direct (our own handshake), cloudflare (the name is on Cloudflare's network, which refuses our servers' connections: certificate from the CT log, see warnings), ipv6 (IPv6-only: we have no IPv6 route), nxdomain, no-address, private, refused, timeout, not-tls, starttls, alert or failed.

    one of "direct", "cloudflare", "ipv6", "nxdomain", "no-address", "private", "refused", "timeout", "not-tls", "starttls", "alert", "failed", null

  • reachDetailstring or nullalways
    The server's alert or the failure, in a few words (e.g. handshake_failure, connect).
  • statestring or nullalways
    The verdict in one word, most serious first. Null when nothing could be checked.

    one of "valid", "expiring", "expired", "not-yet-valid", "untrusted", "mismatch", "revoked", "unreachable", null

  • gradeobject or nullalways
    Our grade, modelled on Qualys SSL Labs' rating guide: A+ to F, T (not trusted) or M (name mismatch). Null when the protocols weren't scanned (sites on Cloudflare, an unfinished scan): a grade without them would mislead.
    • letterstringalways
      The grade.

      one of "A+", "A", "A-", "B", "C", "D", "E", "F", "T", "M"

    • ignoringTruststring or nullalways
      For T and M: the grade the configuration earns once the trust or name problem is fixed.

      one of "A+", "A", "A-", "B", "C", "D", "E", "F", "T", "M", null

    • reasonsarray of objectsalways
      Every setting that caps the grade, with the best letter it allows.
      Show 2 fields
      • codestringalways
        Stable snake_case code: untrusted, mismatch, expired, not_yet_valid, revoked, ssl3, insecure_cipher, weak_key, weak_signature, no_modern_tls, rc4, rc4_used, 64_bit_block, old_tls, no_forward_secrecy, incomplete_chain, no_aead, no_tls13, no_hsts, short_hsts.
      • capstringalways
        The best grade this allows.

        one of "A+", "A", "A-", "B", "C", "D", "E", "F", "T", "M"

  • certificateobject or nullalways
    The certificate the server sent (or, on Cloudflare's network, the newest one in the CT log: see source). Null when none was read.
    Show 25 fields
    • subjectobjectalways
      The subject's distinguished name, by field (null when the field is absent).
      Show 7 fields
      • commonNamestring or nullalways
        CN.
      • organizationstring or nullalways
        O.
      • organizationalUnitstring or nullalways
        OU.
      • localitystring or nullalways
        L (city).
      • statestring or nullalways
        ST (state or province).
      • countrystring or nullalways
        C (ISO country code).
      • dnstringalways
        The whole name as encoded, e.g. C=US, O=Let's Encrypt, CN=R12.
    • issuerobjectalways
      The issuer's distinguished name, by field (null when the field is absent).
      Show 7 fields
      • commonNamestring or nullalways
        CN.
      • organizationstring or nullalways
        O.
      • organizationalUnitstring or nullalways
        OU.
      • localitystring or nullalways
        L (city).
      • statestring or nullalways
        ST (state or province).
      • countrystring or nullalways
        C (ISO country code).
      • dnstringalways
        The whole name as encoded, e.g. C=US, O=Let's Encrypt, CN=R12.
    • caobject or nullalways
      The certificate authority as people know it, or self-signed / private for a certificate no public CA issued. Null when the issuer is unknown to us.
      Show 2 fields
      • idstringalways
        Stable id, e.g. letsencrypt, digicert, sectigo, self-signed, private.
      • namestringalways
        Display name, e.g. Let's Encrypt.
    • namesarray of stringsalways
      DNS names in the Subject Alternative Name extension (the names browsers check), at most 100.
    • nameCountintegeralways
      How many DNS names the certificate covers in all.
    • ipAddressesarray of stringsalways
      IP addresses in the Subject Alternative Name extension.
    • notBeforestringalways
      Valid from (ISO 8601).
    • notAfterstringalways
      Valid until (ISO 8601).
    • daysLeftintegeralways
      Whole days until notAfter at the time of the check; negative once expired.
    • lifetimeDaysintegeralways
      Days between notBefore and notAfter.
    • maxLifetimestring or nullalways
      The longest validity the CA/Browser Forum allows for a certificate issued on notBefore (e.g. 200 days); null for a CA, self-signed or private certificate.
    • keyobjectalways
      The public key.
      Show 4 fields
      • algorithmstringalways
        RSA, EC, Ed25519…
      • bitsinteger or nullalways
        Key size in bits.
      • curvestring or nullalways
        The curve of an EC key, e.g. P-256.
      • postQuantumbooleanalways
        A post-quantum key (ML-DSA).
    • signatureobjectalways
      How the CA signed it.
      Show 2 fields
      • algorithmstringalways
        e.g. sha256WithRSAEncryption, ecdsa-with-SHA256.
      • hashstring or nullalways
        The hash, e.g. SHA-256.
    • serialstringalways
      Serial number, lower-case hex.
    • sha256stringalways
      SHA-256 fingerprint of the certificate, lower-case hex.
    • sha1stringalways
      SHA-1 fingerprint, lower-case hex.
    • spkiSha256stringalways
      SHA-256 of the SubjectPublicKeyInfo, base64 (the HPKP-style pin; TLSA 3 1 1 in hex is the same digest).
    • validationstring or nullalways
      Validation level from the certificate's policy OIDs.

      one of "DV", "OV", "IV", "EV", null

    • selfSignedbooleanalways
      Signed by its own key.
    • mustStaplebooleanalways
      Carries the TLS Feature (Must-Staple) extension.
    • precertificatebooleanalways
      A CT precertificate (only possible when source is ct).
    • sourcestringalways
      Where we got it: sent by the server, or ct, the Certificate Transparency log (sites on Cloudflare).

      one of "sent", "aia", "store", "ct"

    • sctsarray of objectsalways
      Signed Certificate Timestamps (embedded, in the TLS handshake or in a stapled OCSP answer), at most 10.
      Show 4 fields
      • logstring or nullalways
        The CT log, e.g. Google Argon2026h2; null for a log we don't know.
      • operatorstring or nullalways
        Who runs the log.
      • timestringalways
        When the log saw it (ISO 8601).
      • sourcestringalways
        How it was delivered.

        one of "embedded", "tls", "ocsp"

    • ocspUrlsarray of stringsalways
      The CA's OCSP responders from the AIA extension (empty for Let's Encrypt since 2025).
    • crlUrlsarray of stringsalways
      CRL distribution points.
  • hostnameobject or nullalways
    Does the certificate cover the host (RFC 9525: Subject Alternative Names only, one wildcard label)? Null without a certificate.
    Show 4 fields
    • matchesbooleanalways
      It covers the host.
    • matchedNamestring or nullalways
      The SAN entry that matched.
    • wildcardbooleanalways
      The match is a wildcard.
    • commonNameOnlybooleanalways
      The host appears only in the Common Name, which browsers ignore.
  • chainobject or nullalways
    The chain: as sent, the path browsers build, and each root store's verdict. Null when no certificate was read.
    Show 9 fields
    • sentarray of objectsalways
      The certificates the server sent, in order (empty when the certificate came from the CT log).
      Show 3 fields
      • subjectstring or nullalways
        Its subject DN.
      • rolestringalways
        What it is on the path.

        one of "leaf", "intermediate", "root", "extra", "duplicate", "unparseable"

      • sha256string or nullalways
        SHA-256 fingerprint, lower-case hex.
    • inOrderbooleanalways
      Sent leaf first, each next one the previous one's issuer.
    • patharray of objectsalways
      The path browsers use, leaf first (without the root).
      Show 8 fields
      • commonNamestring or nullalways
        Its CN.
      • subjectstringalways
        Its subject DN.
      • issuerstringalways
        Its issuer DN.
      • notAfterstringalways
        Valid until (ISO 8601).
      • keyAlgorithmstringalways
        Its key's algorithm.
      • keyBitsinteger or nullalways
        Its key's size.
      • sha256stringalways
        SHA-256 fingerprint, lower-case hex.
      • sourcestringalways
        sent by the server, fetched from the issuer's aia URL, found in a root store, or from the ct log.

        one of "sent", "aia", "store", "ct"

    • rootobject or nullalways
      The trust anchor the path ends at.
      Show 6 fields
      • namestringalways
        The root's name.
      • ownerstringalways
        The CA that owns it (CCADB).
      • notAfterstringalways
        The root's expiry (ISO 8601).
      • sha256string or nullalways
        The root certificate's SHA-256, lower-case hex.
      • sentbooleanalways
        The server sent a copy of the root (harmless, but wasted bytes).
      • crossSignedBystring or nullalways
        When the copy sent is a cross-sign: the root that signed it.
    • storesobjectalways
      Each root store's verdict, by store.
      Show 4 fields
      • mozillaobjectalways
        Mozilla's (Firefox)'s verdict.
        Show 4 fields
        • trustedbooleanalways
          This store trusts the chain.
        • reasonsarray of objectsalways
          Why not, when it doesn't (chain problem codes).
          Show 3 fields
          • codestringalways
            Stable snake_case code, e.g. expired, untrusted_root, distrusted_after, ct_not_compliant.
          • positioninteger or nullalways
            Which certificate: 0 is the leaf, the path's length is the root; null for the chain as a whole.
          • detailstring or nullalways
            A detail from the checker (a date, a name).
        • ctCompliantboolean or nullalways
          Meets this browser's Certificate Transparency policy; null where the store has none (Microsoft).
        • evbooleanalways
          Shown as Extended Validation by this store.
      • chromeobjectalways
        Chrome's (and Edge's)'s verdict.
        Show 4 fields
        • trustedbooleanalways
          This store trusts the chain.
        • reasonsarray of objectsalways
          Why not, when it doesn't (chain problem codes).
          Show 3 fields
          • codestringalways
            Stable snake_case code, e.g. expired, untrusted_root, distrusted_after, ct_not_compliant.
          • positioninteger or nullalways
            Which certificate: 0 is the leaf, the path's length is the root; null for the chain as a whole.
          • detailstring or nullalways
            A detail from the checker (a date, a name).
        • ctCompliantboolean or nullalways
          Meets this browser's Certificate Transparency policy; null where the store has none (Microsoft).
        • evbooleanalways
          Shown as Extended Validation by this store.
      • appleobjectalways
        Apple's's verdict.
        Show 4 fields
        • trustedbooleanalways
          This store trusts the chain.
        • reasonsarray of objectsalways
          Why not, when it doesn't (chain problem codes).
          Show 3 fields
          • codestringalways
            Stable snake_case code, e.g. expired, untrusted_root, distrusted_after, ct_not_compliant.
          • positioninteger or nullalways
            Which certificate: 0 is the leaf, the path's length is the root; null for the chain as a whole.
          • detailstring or nullalways
            A detail from the checker (a date, a name).
        • ctCompliantboolean or nullalways
          Meets this browser's Certificate Transparency policy; null where the store has none (Microsoft).
        • evbooleanalways
          Shown as Extended Validation by this store.
      • microsoftobjectalways
        Microsoft's's verdict.
        Show 4 fields
        • trustedbooleanalways
          This store trusts the chain.
        • reasonsarray of objectsalways
          Why not, when it doesn't (chain problem codes).
          Show 3 fields
          • codestringalways
            Stable snake_case code, e.g. expired, untrusted_root, distrusted_after, ct_not_compliant.
          • positioninteger or nullalways
            Which certificate: 0 is the leaf, the path's length is the root; null for the chain as a whole.
          • detailstring or nullalways
            A detail from the checker (a date, a name).
        • ctCompliantboolean or nullalways
          Meets this browser's Certificate Transparency policy; null where the store has none (Microsoft).
        • evbooleanalways
          Shown as Extended Validation by this store.
    • trustedAllbooleanalways
      All four stores trust it.
    • trustedAnybooleanalways
      At least one store trusts it.
    • missingIntermediatebooleanalways
      A trusted path needs an intermediate the server didn't send (we fetched it from the issuer's AIA URL; some clients can't).
    • caOwnerstring or nullalways
      The CA behind the chain, as the CCADB names it.
  • revocationobject or nullalways
    Was the certificate revoked? Asked of the CA (stapled OCSP, then OCSP, then the CRL). Null without a certificate.
    Show 9 fields
    • statusstringalways
      good, revoked, unknown (the CA's answer couldn't be read) or error.

      one of "good", "revoked", "unknown", "error"

    • methodstringalways
      How it was checked; none when the CA publishes neither OCSP nor a CRL.

      one of "ocsp-stapled", "ocsp", "crl", "none"

    • revokedAtstring or nullalways
      When it was revoked (ISO 8601).
    • reasonstring or nullalways
      The CA's revocation reason.
    • stapledbooleanalways
      The server stapled an OCSP response.
    • mustStapleViolatedbooleanalways
      Must-Staple certificate without a stapled response (Firefox refuses it).
    • ocspUrlstring or nullalways
      The OCSP responder asked.
    • crlUrlstring or nullalways
      The CRL read.
    • detailstring or nullalways
      Why the status is unknown, in a few words.
  • connectionobject or nullalways
    The TLS session our handshake negotiated (offering what a current browser offers). Null when there was no handshake.
    Show 8 fields
    • protocolstring or nullalways
      e.g. TLS 1.3.
    • cipherstring or nullalways
      IANA name, e.g. TLS_AES_128_GCM_SHA256.
    • groupstring or nullalways
      Key exchange group, e.g. x25519, X25519MLKEM768.
    • alpnstring or nullalways
      The application protocol picked (h2, http/1.1).
    • signatureSchemestring or nullalways
      The server's handshake signature, e.g. ecdsa_secp256r1_sha256.
    • ocspStapledbooleanalways
      An OCSP response was stapled.
    • connectMsinteger or nullalways
      TCP connect time from our server.
    • handshakeMsinteger or nullalways
      TLS handshake time from our server.
  • protocolsobject or nullalways
    Which protocol versions the server accepts: true/false as tested, null when a probe got no clear answer (never counted against the site). Null when not scanned.
    Show 5 fields
    • ssl3boolean or nullalways
      SSL 3.0.
    • tls10boolean or nullalways
      TLS 1.0.
    • tls11boolean or nullalways
      TLS 1.1.
    • tls12boolean or nullalways
      TLS 1.2.
    • tls13boolean or nullalways
      TLS 1.3.
  • ciphersobject or nullalways
    Accepted cipher suites (IANA names) per version; TLS 1.1/1.0 suites only on a server without TLS 1.2. Null when not scanned.
    Show 6 fields
    • tls13array of stringsalways
      TLS 1.3 suites.
    • tls12array of stringsalways
      TLS 1.2 suites.
    • tls11array of stringsalways
      TLS 1.1 suites.
    • tls10array of stringsalways
      TLS 1.0 suites.
    • serverOrderboolean or nullalways
      The server picks the suite by its own preference.
    • cappedbooleanalways
      The scan stopped at its probe limit: more suites may be accepted.
  • groupsobject or nullalways
    Key exchange groups accepted with TLS 1.3. Null when not scanned.
    • acceptedarray of stringsalways
      Accepted groups.
    • postQuantumarray of stringsalways
      Accepted post-quantum hybrids (ML-KEM).
    • prefersPostQuantumboolean or nullalways
      The server picks a post-quantum group when offered one.
  • httpobject or nullalways
    The site's HTTPS answer (port 443-style services only). Null for mail and other services, or when it didn't answer.
    Show 8 fields
    • statusinteger or nullalways
      The HTTPS answer's status.
    • hstsobject or nullalways
      The Strict-Transport-Security header, parsed.
      Show 3 fields
      • maxAgeintegeralways
        max-age in seconds.
      • includeSubDomainsbooleanalways
        includeSubDomains.
      • preloadbooleanalways
        preload.
    • hstsInvalidbooleanalways
      An HSTS header was sent but can't be parsed (browsers ignore it).
    • redirectsToHttpsboolean or nullalways
      http:// on port 80 redirects to https://.
    • http3booleanalways
      HTTP/3 is advertised (Alt-Svc).
    • serverstring or nullalways
      The Server header.
    • preloadstringalways
      The name's status on Chrome's HSTS preload list.

      one of "preloaded", "pending", "eligible", "no", "unknown"

    • preloadedBystring or nullalways
      The parent whose preload entry covers this name.
  • dnsobject or nullalways
    What DNS says about the name (null for an IP address).
    Show 7 fields
    • addressesarray of stringsalways
      A and AAAA records.
    • cnamearray of stringsalways
      The CNAME chain.
    • caaarray of objectsalways
      CAA records that apply (the name's own or its closest parent's).
      Show 3 fields
      • flagsintegeralways
        Flags.
      • tagstringalways
        issue, issuewild or iodef.
      • valuestringalways
        The value, e.g. letsencrypt.org.
    • caaFromstring or nullalways
      The name the CAA records were found at.
    • caaAllowsboolean or nullalways
      CAA lets this certificate's CA issue; null when no CAA applies or the CA's domains are unknown.
    • httpsRecordobject or nullalways
      The HTTPS (SVCB) record.
      Show 2 fields
      • alpnarray of stringsalways
        ALPN ids it advertises.
      • echbooleanalways
        It publishes an Encrypted Client Hello config.
    • daneobject or nullalways
      TLSA (DANE) records for the port.
      Show 3 fields
      • recordsintegeralways
        How many.
      • dnssecbooleanalways
        The answer was DNSSEC-validated.
      • matchesboolean or nullalways
        A record matches the served chain; null when none can be compared.
  • ctobject or nullalways
    Certificate Transparency history for the name (Cert Spotter; unexpired certificates only). Null when the log didn't answer or for an IP.
    Show 6 fields
    • totalintegeralways
      Unexpired certificates logged for the name.
    • morebooleanalways
      The log returned a full page: there may be more.
    • casarray of stringsalways
      CAs that issue for the name.
    • renewalDaysinteger or nullalways
      The usual days between renewals of the served certificate's series.
    • servedIndexinteger or nullalways
      Position of the served certificate among the newest logged ones (0 = newest), null when it isn't among the newest 12.
    • recentarray of objectsalways
      The newest logged certificates, at most 5.
      Show 7 fields
      • sha256stringalways
        Fingerprint.
      • issuerstringalways
        The CA.
      • notBeforestringalways
        Valid from.
      • notAfterstringalways
        Valid until.
      • lifetimeDaysintegeralways
        Validity in days.
      • namesintegeralways
        Names it covers.
      • coversstringalways
        How it covers this name.

        one of "exact", "wildcard"

  • issuesarray of objectsalways
    Problems found in the target's configuration, worst first. Empty when there are none.
    • severitystringalways
      error breaks something, warning risks it, info is worth knowing.

      one of "error", "warning", "info"

    • codestringalways
      Stable machine-readable code.
    • messagestringalways
      The problem and what to do about it, in plain English.

Errors

  • 422 target_not_allowed A private or reserved name or address, an IPv6 address (we have no IPv6 route yet: send the hostname), or port 25.

Plus the errors every endpoint can return: 400 for a missing or unreadable parameter, 429 past the limit, 503 when every source failed.

Code samples

curl "https://dnsrobot.net/api/v2/ssl?host=github.com"
const params = new URLSearchParams({ host: "github.com" });
const res = await fetch(`https://dnsrobot.net/api/v2/ssl?${params}`);
const data = await res.json();
if (!res.ok) throw new Error(data.error.message);
console.log(data.grade);
import requests

r = requests.get(
    "https://dnsrobot.net/api/v2/ssl",
    params={"host": "github.com"},
    timeout=30,
)
data = r.json()
if not r.ok:
    raise RuntimeError(data["error"]["message"])
print(data["grade"])
package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
)

func main() {
	q := url.Values{"host": {"github.com"}}
	res, err := http.Get("https://dnsrobot.net/api/v2/ssl?" + q.Encode())
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	var data map[string]any
	if err := json.NewDecoder(res.Body).Decode(&data); err != nil {
		panic(err)
	}
	if res.StatusCode != http.StatusOK {
		panic(data["error"])
	}
	fmt.Println(data["grade"])
}
<?php
$query = http_build_query(["host" => "github.com"]);
$context = stream_context_create(["http" => ["ignore_errors" => true, "timeout" => 30]]);
$data = json_decode(file_get_contents("https://dnsrobot.net/api/v2/ssl?" . $query, false, $context), true);
if (isset($data["error"])) {
    throw new RuntimeException($data["error"]["message"]);
}
print_r($data["grade"]);
require "net/http"
require "json"

uri = URI("https://dnsrobot.net/api/v2/ssl")
uri.query = URI.encode_www_form(host: "github.com")
data = JSON.parse(Net::HTTP.get(uri))
raise data["error"]["message"] if data["error"]
puts data["grade"]
// Cargo.toml: reqwest = { version = "0.13", features = ["blocking", "json"] }, serde_json = "1"
fn main() -> Result<(), Box<dyn std::error::Error>> {
    let res = reqwest::blocking::get("https://dnsrobot.net/api/v2/ssl?host=github.com")?;
    let ok = res.status().is_success();
    let data: serde_json::Value = res.json()?;
    if !ok {
        return Err(data["error"]["message"].to_string().into());
    }
    println!("{}", data["grade"]);
    Ok(())
}
using System.Text.Json;

using var http = new HttpClient();
var res = await http.GetAsync("https://dnsrobot.net/api/v2/ssl?host=github.com");
var data = JsonDocument.Parse(await res.Content.ReadAsStringAsync()).RootElement;
if (!res.IsSuccessStatusCode)
    throw new Exception(data.GetProperty("error").GetProperty("message").GetString());
Console.WriteLine(data.GetProperty("grade"));

github.com: A+, trusted everywhere

GET /api/v2/ssl?host=github.com
200 OKRecorded 2026-10-25
{
  "query": {
    "host": "github.com",
    "port": 443
  },
  "service": "https",
  "starttls": null,
  "checkedAt": "2026-10-25T08:13:22.503Z",
  "ip": "140.82.114.4",
  "reach": "direct",
  "reachDetail": null,
  "state": "valid",
  "grade": {
    "letter": "A+",
    "ignoringTrust": null,
    "reasons": []
  },
  "certificate": {
    "subject": {
      "commonName": "github.com",
      "organization": null,
      "organizationalUnit": null,
      "locality": null,
      "state": null,
      "country": null,
      "dn": "CN=github.com"
    },
    "issuer": {
      "commonName": "Sectigo Public Server Authentication CA DV E36",
      "organization": "Sectigo Limited",
      "organizationalUnit": null,
      "locality": null,
      "state": null,
      "country": "GB",
      "dn": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36"
    },
    "ca": {
      "id": "sectigo",
      "name": "Sectigo"
    },
    "names": [
      "github.com",
      "www.github.com"
    ],
    "nameCount": 2,
    "ipAddresses": [],
    "notBefore": "2026-09-01T00:00:00.000Z",
    "notAfter": "2026-11-29T23:59:59.000Z",
    "daysLeft": 35,
    "lifetimeDays": 90,
    "maxLifetime": "200 days",
    "key": {
      "algorithm": "EC",
      "bits": 256,
      "curve": "P-256",
      "postQuantum": false
    },
    "signature": {
      "algorithm": "ecdsa-with-SHA256",
      "hash": "SHA-256"
    },
    "serial": "a59ebdb596751db7f5c095079613953c",
    "sha256": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63",
    "sha1": "d3b63e61c64fd29ba9b8729628f8697f556a341f",
    "spkiSha256": "/wiL5vgOLgwED41WS0DNF8QiTBVR/P41Kd163tmFxK0=",
    "validation": "DV",
    "selfSigned": false,
    "mustStaple": false,
    "precertificate": false,
    "source": "sent",
    "scts": [
      {
        "log": "Google Argon2026h2",
        "operator": "Google",
        "time": "2026-09-01T00:10:32.017Z",
        "source": "embedded"
      },
      {
        "log": "Sectigo Tiger2026h2",
        "operator": "Sectigo",
        "time": "2026-09-01T00:10:31.981Z",
        "source": "embedded"
      }
    ],
    "ocspUrls": [
      "http://ocsp.sectigo.com"
    ],
    "crlUrls": []
  },
  "hostname": {
    "matches": true,
    "matchedName": "github.com",
    "wildcard": false,
    "commonNameOnly": false
  },
  "chain": {
    "sent": [
      {
        "subject": "CN=github.com",
        "role": "leaf",
        "sha256": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63"
      },
      {
        "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
        "role": "intermediate",
        "sha256": "873f0ba80e3ac222656dfd04158cc15c2927d42d5d05f01dee4a47eb43a916df"
      },
      {
        "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46",
        "role": "intermediate",
        "sha256": "ea6b89ed6907a209ff9188676fb164e7aced894b8996dfbe5ce5bbcc22de4ddd"
      }
    ],
    "inOrder": true,
    "path": [
      {
        "commonName": "github.com",
        "subject": "CN=github.com",
        "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
        "notAfter": "2026-11-29T23:59:59.000Z",
        "keyAlgorithm": "EC",
        "keyBits": 256,
        "sha256": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63",
        "source": "sent"
      },
      {
        "commonName": "Sectigo Public Server Authentication CA DV E36",
        "subject": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
        "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root E46",
        "notAfter": "2036-03-21T23:59:59.000Z",
        "keyAlgorithm": "EC",
        "keyBits": 256,
        "sha256": "873f0ba80e3ac222656dfd04158cc15c2927d42d5d05f01dee4a47eb43a916df",
        "source": "sent"
      }
    ],
    "root": {
      "name": "Sectigo Public Server Authentication Root E46",
      "owner": "Sectigo",
      "notAfter": "2046-03-21T23:59:59.000Z",
      "sha256": "c90f26f0fb1b4018b22227519b5ca2b53e2ca5b3be5cf18efe1bef47380c5383",
      "sent": true,
      "crossSignedBy": "USERTrust ECC Certification Authority"
    },
    "stores": {
      "mozilla": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "chrome": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "apple": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "microsoft": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": null,
        "ev": false
      }
    },
    "trustedAll": true,
    "trustedAny": true,
    "missingIntermediate": false,
    "caOwner": "Sectigo"
  },
  "revocation": {
    "status": "good",
    "method": "ocsp",
    "revokedAt": null,
    "reason": null,
    "stapled": false,
    "mustStapleViolated": false,
    "ocspUrl": "http://ocsp.sectigo.com",
    "crlUrl": null,
    "detail": null
  },
  "connection": {
    "protocol": "TLS 1.3",
    "cipher": "TLS_AES_128_GCM_SHA256",
    "group": "x25519",
    "alpn": "h2",
    "signatureScheme": "ecdsa_secp256r1_sha256",
    "ocspStapled": false,
    "connectMs": 207,
    "handshakeMs": 415
  },
  "protocols": {
    "ssl3": false,
    "tls10": false,
    "tls11": false,
    "tls12": true,
    "tls13": true
  },
  "ciphers": {
    "tls13": [
      "TLS_AES_128_GCM_SHA256",
      "TLS_AES_256_GCM_SHA384",
      "TLS_CHACHA20_POLY1305_SHA256"
    ],
    "tls12": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_RSA_WITH_AES_256_CBC_SHA256",
      // … 11 more items
    ],
    "tls11": [],
    "tls10": [],
    "serverOrder": false,
    "capped": false
  },
  "groups": {
    "accepted": [
      "x25519",
      "secp256r1"
    ],
    "postQuantum": [],
    "prefersPostQuantum": null
  },
  "http": {
    "status": 200,
    "hsts": {
      "maxAge": 31536000,
      "includeSubDomains": true,
      "preload": true
    },
    "hstsInvalid": false,
    "redirectsToHttps": true,
    "http3": false,
    "server": "github.com",
    "preload": "preloaded",
    "preloadedBy": null
  },
  "dns": {
    "addresses": [
      "140.82.114.4"
    ],
    "cname": [],
    "caa": [
      {
        "flags": 0,
        "tag": "issue",
        "value": "letsencrypt.org"
      },
      {
        "flags": 0,
        "tag": "issuewild",
        "value": "letsencrypt.org"
      },
      {
        "flags": 0,
        "tag": "issuewild",
        "value": "digicert.com"
      },
      // … 4 more items
    ],
    "caaFrom": "github.com",
    "caaAllows": true,
    "httpsRecord": null,
    "dane": {
      "records": 0,
      "dnssec": false,
      "matches": null
    }
  },
  "ct": {
    "total": 11,
    "more": false,
    "cas": [
      "Sectigo",
      "Let's Encrypt"
    ],
    "renewalDays": 6,
    "servedIndex": 4,
    "recent": [
      {
        "sha256": "d0047fd64e27c628fdf51599b5495d13943770595ad4b8ce45730bb9e9ea3ef7",
        "issuer": "Sectigo",
        "notBefore": "2026-10-14T00:00:00Z",
        "notAfter": "2027-01-11T23:59:59Z",
        "lifetimeDays": 90,
        "names": 4,
        "covers": "exact"
      },
      {
        "sha256": "f948860125446a8878f709c82d7512ec1b4dfb85fe004aefe7ad33a03b645190",
        "issuer": "Sectigo",
        "notBefore": "2026-10-08T00:00:00Z",
        "notAfter": "2027-01-05T23:59:59Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "exact"
      },
      {
        "sha256": "d98af57e2f20997004dd087e2f0506c2638e9f8d1ff8af6995b317e749670b04",
        "issuer": "Sectigo",
        "notBefore": "2026-10-02T00:00:00Z",
        "notAfter": "2026-12-30T23:59:59Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "exact"
      },
      // … 2 more items
    ]
  },
  "issues": [],
  "tookMs": 4877
}

Shortened for the page: long lists show their first items.

Gmail's SMTP submission port (STARTTLS)

GET /api/v2/ssl?host=smtp.gmail.com&port=587
200 OKRecorded 2026-10-25
{
  "query": {
    "host": "smtp.gmail.com",
    "port": 587
  },
  "service": "smtp",
  "starttls": "smtp",
  "checkedAt": "2026-10-25T08:13:27.467Z",
  "ip": "142.251.127.108",
  "reach": "direct",
  "reachDetail": null,
  "state": "valid",
  "grade": {
    "letter": "B",
    "ignoringTrust": null,
    "reasons": [
      {
        "code": "old_tls",
        "cap": "B"
      }
    ]
  },
  "certificate": {
    "subject": {
      "commonName": "smtp.gmail.com",
      "organization": null,
      "organizationalUnit": null,
      "locality": null,
      "state": null,
      "country": null,
      "dn": "CN=smtp.gmail.com"
    },
    "issuer": {
      "commonName": "WE2",
      "organization": "Google Trust Services",
      "organizationalUnit": null,
      "locality": null,
      "state": null,
      "country": "US",
      "dn": "C=US, O=Google Trust Services, CN=WE2"
    },
    "ca": {
      "id": "google",
      "name": "Google Trust Services"
    },
    "names": [
      "smtp.gmail.com"
    ],
    "nameCount": 1,
    "ipAddresses": [],
    "notBefore": "2026-09-28T18:40:02.000Z",
    "notAfter": "2026-12-21T18:40:01.000Z",
    "daysLeft": 57,
    "lifetimeDays": 84,
    "maxLifetime": "200 days",
    "key": {
      "algorithm": "EC",
      "bits": 256,
      "curve": "P-256",
      "postQuantum": false
    },
    "signature": {
      "algorithm": "ecdsa-with-SHA256",
      "hash": "SHA-256"
    },
    "serial": "aa2f044e9f5e791010f687b1b2191df5",
    "sha256": "9154c1853dbba86b5c09e02e1136a73ce63464e923281f14aff2e612844887af",
    "sha1": "e3ae63ba63fb55322a869b51edc46813b602b96d",
    "spkiSha256": "LjaVYvTx50ZegFgo0iDx1IX6E0eWYtpQsOf9+FkfKmU=",
    "validation": "DV",
    "selfSigned": false,
    "mustStaple": false,
    "precertificate": false,
    "source": "sent",
    "scts": [
      {
        "log": "Google Xenon2026h2",
        "operator": "Google",
        "time": "2026-09-28T19:40:03.324Z",
        "source": "embedded"
      },
      {
        "log": "DigiCert Wyvern2026h2",
        "operator": "DigiCert",
        "time": "2026-09-28T19:40:04.286Z",
        "source": "embedded"
      }
    ],
    "ocspUrls": [],
    "crlUrls": [
      "http://c.pki.goog/we2/Gt0Gl6QoGAU.crl"
    ]
  },
  "hostname": {
    "matches": true,
    "matchedName": "smtp.gmail.com",
    "wildcard": false,
    "commonNameOnly": false
  },
  "chain": {
    "sent": [
      {
        "subject": "CN=smtp.gmail.com",
        "role": "leaf",
        "sha256": "9154c1853dbba86b5c09e02e1136a73ce63464e923281f14aff2e612844887af"
      },
      {
        "subject": "C=US, O=Google Trust Services, CN=WE2",
        "role": "intermediate",
        "sha256": "9c3f2fd11c57d7c649ad5a0932c0f0d29756f6a0a1c74c43e1e89a62d64cd320"
      },
      {
        "subject": "C=US, O=Google Trust Services LLC, CN=GTS Root R4",
        "role": "intermediate",
        "sha256": "76b27b80a58027dc3cf1da68dac17010ed93997d0b603e2fadbe85012493b5a7"
      }
    ],
    "inOrder": true,
    "path": [
      {
        "commonName": "smtp.gmail.com",
        "subject": "CN=smtp.gmail.com",
        "issuer": "C=US, O=Google Trust Services, CN=WE2",
        "notAfter": "2026-12-21T18:40:01.000Z",
        "keyAlgorithm": "EC",
        "keyBits": 256,
        "sha256": "9154c1853dbba86b5c09e02e1136a73ce63464e923281f14aff2e612844887af",
        "source": "sent"
      },
      {
        "commonName": "WE2",
        "subject": "C=US, O=Google Trust Services, CN=WE2",
        "issuer": "C=US, O=Google Trust Services LLC, CN=GTS Root R4",
        "notAfter": "2029-02-20T14:00:00.000Z",
        "keyAlgorithm": "EC",
        "keyBits": 256,
        "sha256": "9c3f2fd11c57d7c649ad5a0932c0f0d29756f6a0a1c74c43e1e89a62d64cd320",
        "source": "sent"
      }
    ],
    "root": {
      "name": "GTS Root R4",
      "owner": "Google Trust Services LLC",
      "notAfter": "2036-06-22T23:59:59.000Z",
      "sha256": "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d",
      "sent": true,
      "crossSignedBy": "GlobalSign Root CA"
    },
    "stores": {
      "mozilla": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "chrome": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "apple": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": true,
        "ev": false
      },
      "microsoft": {
        "trusted": true,
        "reasons": [],
        "ctCompliant": null,
        "ev": false
      }
    },
    "trustedAll": true,
    "trustedAny": true,
    "missingIntermediate": false,
    "caOwner": "Google Trust Services LLC"
  },
  "revocation": {
    "status": "good",
    "method": "crl",
    "revokedAt": null,
    "reason": null,
    "stapled": false,
    "mustStapleViolated": false,
    "ocspUrl": null,
    "crlUrl": "http://c.pki.goog/we2/Gt0Gl6QoGAU.crl",
    "detail": null
  },
  "connection": {
    "protocol": "TLS 1.3",
    "cipher": "TLS_AES_128_GCM_SHA256",
    "group": "x25519",
    "alpn": null,
    "signatureScheme": "ecdsa_secp256r1_sha256",
    "ocspStapled": false,
    "connectMs": 259,
    "handshakeMs": 1353
  },
  "protocols": {
    "ssl3": false,
    "tls10": true,
    "tls11": true,
    "tls12": true,
    "tls13": true
  },
  "ciphers": {
    "tls13": [
      "TLS_AES_128_GCM_SHA256",
      "TLS_AES_256_GCM_SHA384",
      "TLS_CHACHA20_POLY1305_SHA256"
    ],
    "tls12": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_RSA_WITH_AES_128_CBC_SHA",
      "TLS_RSA_WITH_AES_256_CBC_SHA",
      // … 11 more items
    ],
    "tls11": [],
    "tls10": [],
    "serverOrder": false,
    "capped": false
  },
  "groups": {
    "accepted": [
      "x25519",
      "secp256r1",
      "X25519MLKEM768"
    ],
    "postQuantum": [
      "X25519MLKEM768"
    ],
    "prefersPostQuantum": true
  },
  "http": null,
  "dns": {
    "addresses": [
      "142.251.127.108",
      "2a00:1450:4001:c21::6d"
    ],
    "cname": [],
    "caa": [
      {
        "flags": 0,
        "tag": "issue",
        "value": "pki.goog"
      }
    ],
    "caaFrom": "gmail.com",
    "caaAllows": true,
    "httpsRecord": null,
    "dane": {
      "records": 0,
      "dnssec": false,
      "matches": null
    }
  },
  "ct": null,
  "issues": [
    {
      "severity": "warning",
      "code": "old_tls",
      "message": "TLS 1.0 or 1.1 is still enabled. Browsers dropped both in 2020; turn them off."
    }
  ],
  "tookMs": 13938,
  "incomplete": true,
  "warnings": [
    {
      "code": "ct_unavailable",
      "message": "The Certificate Transparency log (Cert Spotter) didn't answer."
    }
  ]
}

Shortened for the page: long lists show their first items.

expired.badssl.com: an expired certificate (T)

GET /api/v2/ssl?host=expired.badssl.com
200 OKRecorded 2026-10-25
{
  "query": {
    "host": "expired.badssl.com",
    "port": 443
  },
  "service": "https",
  "starttls": null,
  "checkedAt": "2026-10-25T08:13:41.456Z",
  "ip": "104.154.89.105",
  "reach": "direct",
  "reachDetail": null,
  "state": "expired",
  "grade": {
    "letter": "T",
    "ignoringTrust": "F",
    "reasons": [
      {
        "code": "untrusted",
        "cap": "T"
      },
      {
        "code": "expired",
        "cap": "F"
      },
      {
        "code": "64_bit_block",
        "cap": "C"
      },
      // … 3 more items
    ]
  },
  "certificate": {
    "subject": {
      "commonName": "*.badssl.com",
      "organization": null,
      "organizationalUnit": "Domain Control Validated",
      "locality": null,
      "state": null,
      "country": null,
      "dn": "OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.badssl.com"
    },
    "issuer": {
      "commonName": "COMODO RSA Domain Validation Secure Server CA",
      "organization": "COMODO CA Limited",
      "organizationalUnit": null,
      "locality": "Salford",
      "state": "Greater Manchester",
      "country": "GB",
      "dn": "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Sec…"
    },
    "ca": {
      "id": "sectigo",
      "name": "Sectigo"
    },
    "names": [
      "*.badssl.com",
      "badssl.com"
    ],
    "nameCount": 2,
    "ipAddresses": [],
    "notBefore": "2015-04-09T00:00:00.000Z",
    "notAfter": "2015-04-12T23:59:59.000Z",
    "daysLeft": -4214,
    "lifetimeDays": 4,
    "maxLifetime": null,
    "key": {
      "algorithm": "RSA",
      "bits": 2048,
      "curve": null,
      "postQuantum": false
    },
    "signature": {
      "algorithm": "sha256WithRSAEncryption",
      "hash": "SHA-256"
    },
    "serial": "4ae79549fa9abe3f100f17a478e16909",
    "sha256": "ba105ce02bac76888ecee47cd4eb7941653e9ac993b61b2eb3dcc82014d21b4f",
    "sha1": "404bbd2f1f4cc2fdeef13aabdd523ef61f1c71f3",
    "spkiSha256": "9SLklscvzMYj8f+52lp5ze/hY0CFHyLSPQzSpYYIBm8=",
    "validation": "DV",
    "selfSigned": false,
    "mustStaple": false,
    "precertificate": false,
    "source": "sent",
    "scts": [],
    "ocspUrls": [
      "http://ocsp.comodoca.com"
    ],
    "crlUrls": [
      "http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl"
    ]
  },
  "hostname": {
    "matches": true,
    "matchedName": "*.badssl.com",
    "wildcard": true,
    "commonNameOnly": false
  },
  "chain": {
    "sent": [
      {
        "subject": "OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.badssl.com",
        "role": "leaf",
        "sha256": "ba105ce02bac76888ecee47cd4eb7941653e9ac993b61b2eb3dcc82014d21b4f"
      },
      {
        "subject": "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Sec…",
        "role": "intermediate",
        "sha256": "02ab57e4e67a0cb48dd2ff34830e8ac40f4476fb08ca6be3f5cd846f646840f0"
      },
      {
        "subject": "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authori…",
        "role": "intermediate",
        "sha256": "4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da"
      }
    ],
    "inOrder": true,
    "path": [
      {
        "commonName": "*.badssl.com",
        "subject": "OU=Domain Control Validated, OU=PositiveSSL Wildcard, CN=*.badssl.com",
        "issuer": "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Sec…",
        "notAfter": "2015-04-12T23:59:59.000Z",
        "keyAlgorithm": "RSA",
        "keyBits": 2048,
        "sha256": "ba105ce02bac76888ecee47cd4eb7941653e9ac993b61b2eb3dcc82014d21b4f",
        "source": "sent"
      },
      {
        "commonName": "COMODO RSA Domain Validation Secure Server CA",
        "subject": "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Sec…",
        "issuer": "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authori…",
        "notAfter": "2029-02-11T23:59:59.000Z",
        "keyAlgorithm": "RSA",
        "keyBits": 2048,
        "sha256": "02ab57e4e67a0cb48dd2ff34830e8ac40f4476fb08ca6be3f5cd846f646840f0",
        "source": "sent"
      }
    ],
    "root": {
      "name": "COMODO RSA Certification Authority",
      "owner": "Sectigo",
      "notAfter": "2038-01-18T23:59:59.000Z",
      "sha256": "52f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234",
      "sent": true,
      "crossSignedBy": "AddTrust External CA Root"
    },
    "stores": {
      "mozilla": {
        "trusted": false,
        "reasons": [
          {
            "code": "expired",
            "position": 0,
            "detail": "2015-04-12T23:59:59.000Z"
          }
        ],
        "ctCompliant": null,
        "ev": false
      },
      "chrome": {
        "trusted": false,
        "reasons": [
          {
            "code": "expired",
            "position": 0,
            "detail": "2015-04-12T23:59:59.000Z"
          },
          {
            "code": "distrusted_after",
            "position": 2,
            "detail": "2026-09-30T23:59:59.000Z"
          }
        ],
        "ctCompliant": null,
        "ev": false
      },
      "apple": {
        "trusted": false,
        "reasons": [
          {
            "code": "expired",
            "position": 0,
            "detail": "2015-04-12T23:59:59.000Z"
          }
        ],
        "ctCompliant": null,
        "ev": false
      },
      "microsoft": {
        "trusted": false,
        "reasons": [
          {
            "code": "expired",
            "position": 0,
            "detail": "2015-04-12T23:59:59.000Z"
          }
        ],
        "ctCompliant": null,
        "ev": false
      }
    },
    "trustedAll": false,
    "trustedAny": false,
    "missingIntermediate": false,
    "caOwner": "Sectigo"
  },
  "revocation": {
    "status": "good",
    "method": "crl",
    "revokedAt": null,
    "reason": null,
    "stapled": false,
    "mustStapleViolated": false,
    "ocspUrl": "http://ocsp.comodoca.com",
    "crlUrl": "http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl",
    "detail": "The responder answered \"unauthorized\""
  },
  "connection": {
    "protocol": "TLS 1.2",
    "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "group": "secp256r1",
    "alpn": "http/1.1",
    "signatureScheme": "rsa_pkcs1_sha512",
    "ocspStapled": false,
    "connectMs": 259,
    "handshakeMs": 536
  },
  "protocols": {
    "ssl3": false,
    "tls10": true,
    "tls11": true,
    "tls12": true,
    "tls13": false
  },
  "ciphers": {
    "tls13": [],
    "tls12": [
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
      "TLS_RSA_WITH_AES_128_CBC_SHA",
      // … 17 more items
    ],
    "tls11": [],
    "tls10": [],
    "serverOrder": true,
    "capped": false
  },
  "groups": {
    "accepted": [],
    "postQuantum": [],
    "prefersPostQuantum": null
  },
  "http": {
    "status": 526,
    "hsts": null,
    "hstsInvalid": false,
    "redirectsToHttps": true,
    "http3": false,
    "server": "cloudflare",
    "preload": "unknown",
    "preloadedBy": null
  },
  "dns": {
    "addresses": [
      "104.154.89.105"
    ],
    "cname": [],
    "caa": [],
    "caaFrom": null,
    "caaAllows": null,
    "httpsRecord": null,
    "dane": {
      "records": 0,
      "dnssec": false,
      "matches": null
    }
  },
  "ct": {
    "total": 8,
    "more": false,
    "cas": [
      "Let's Encrypt"
    ],
    "renewalDays": null,
    "servedIndex": null,
    "recent": [
      {
        "sha256": "5b6d7d8375ce0e7fc9edf9a43d61e3435823729d35dc4d25cd696394fe6513a7",
        "issuer": "Let's Encrypt",
        "notBefore": "2026-09-29T20:03:06Z",
        "notAfter": "2026-12-28T20:03:05Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "wildcard"
      },
      {
        "sha256": "101154813e8fdab6ba4fab575185c1a13944bcec1d849ae2cd94a073494997e3",
        "issuer": "Let's Encrypt",
        "notBefore": "2026-09-29T20:02:56Z",
        "notAfter": "2026-12-28T20:02:55Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "wildcard"
      },
      {
        "sha256": "04c27d6a469f4f9b6e382385f1db17b8486cb6ae1c1fc73aa0957e9922626e15",
        "issuer": "Let's Encrypt",
        "notBefore": "2026-09-29T20:02:50Z",
        "notAfter": "2026-12-28T20:02:49Z",
        "lifetimeDays": 90,
        "names": 2,
        "covers": "wildcard"
      },
      // … 2 more items
    ]
  },
  "issues": [
    {
      "severity": "error",
      "code": "certificate_expired",
      "message": "The certificate expired on 2015-04-12 (4214 days ago). Renew it."
    },
    {
      "severity": "warning",
      "code": "64_bit_block",
      "message": "3DES is still chosen for modern clients (Sweet32). Remove 3DES suites or put them last with serv…"
    },
    {
      "severity": "warning",
      "code": "old_tls",
      "message": "TLS 1.0 or 1.1 is still enabled. Browsers dropped both in 2020; turn them off."
    },
    // … 2 more items
  ],
  "tookMs": 7861
}

Shortened for the page: long lists show their first items.