SSL Scanner

curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch(
  "https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();

import requests

res = requests.get(
    "https://api.pocketutils.com/v1/ssl-scan",
    params={"domain": "example.com"},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]

{
  "success": true,
  "data": {
    "domain": "example.com",
    "port": 443,
    "protocol": "TLSv1.3",
    "certificate": {
      "subject": { "CN": "example.com" },
      "issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
      "valid_from": "2026-01-15T00:00:00.000Z",
      "valid_to": "2027-02-15T23:59:59.000Z",
      "fingerprint": "AB:CD:12:34:...",
      "fingerprint256": "12:34:AB:CD:...",
      "serialNumber": "0A1B2C3D4E5F",
      "altNames": ["example.com", "www.example.com"],
      "keySize": 2048,
      "sigalg": "RSA-SHA256"
    },
    "chain": [
      { "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
    ],
    "isValid": true,
    "daysUntilExpiry": 209,
    "isExpired": false,
    "certValidations": {
      "selfSigned": false,
      "chainComplete": true,
      "trustedCert": true,
      "commonNameValid": true,
      "sanValid": true
    },
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "securityGrade": "A+",
    "score": 97
  }
}

GET

ssl-scan

curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch(
  "https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();

import requests

res = requests.get(
    "https://api.pocketutils.com/v1/ssl-scan",
    params={"domain": "example.com"},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]

{
  "success": true,
  "data": {
    "domain": "example.com",
    "port": 443,
    "protocol": "TLSv1.3",
    "certificate": {
      "subject": { "CN": "example.com" },
      "issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
      "valid_from": "2026-01-15T00:00:00.000Z",
      "valid_to": "2027-02-15T23:59:59.000Z",
      "fingerprint": "AB:CD:12:34:...",
      "fingerprint256": "12:34:AB:CD:...",
      "serialNumber": "0A1B2C3D4E5F",
      "altNames": ["example.com", "www.example.com"],
      "keySize": 2048,
      "sigalg": "RSA-SHA256"
    },
    "chain": [
      { "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
    ],
    "isValid": true,
    "daysUntilExpiry": 209,
    "isExpired": false,
    "certValidations": {
      "selfSigned": false,
      "chainComplete": true,
      "trustedCert": true,
      "commonNameValid": true,
      "sanValid": true
    },
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "securityGrade": "A+",
    "score": 97
  }
}

Opens a TLS connection to the domain and inspects what it presents: the leaf certificate, the full chain, negotiated protocol version and cipher suite, and a set of validity checks (expiry, hostname match, chain completeness, trust). Rolls up into a security grade.

1 credit per call · Typical response time ~220ms

Query parameters

domain

string

required

Domain to scan, e.g. example.com. No scheme or path — just the hostname.

Response

success

boolean

required

Always true for a 200 response.

data

object

required

Hide properties

domain

string

required

Echoes the requested domain.

port

integer

required

Always 443.

protocol

string

required

Negotiated protocol, e.g. "TLSv1.3".

certificate

object

required

Show properties

subject

object

required

Certificate subject fields (CN, O, …).

issuer

object

required

Issuer fields, same shape as subject.

valid_from

string

required

ISO 8601 timestamp.

valid_to

string

required

ISO 8601 timestamp.

fingerprint

string

required

SHA-1 fingerprint.

fingerprint256

string

required

SHA-256 fingerprint.

serialNumber

string

required

Certificate serial number.

altNames

array

required

Subject Alternative Names covered by this certificate.

keySize

integer

Public key size in bits, when available.

sigalg

string

Signature algorithm, when available.

chain

array

required

Intermediate and root certificates. Each entry has the same shape as certificate, minus keySize and sigalg.

isValid

boolean

required

true if the certificate passes every check below.

daysUntilExpiry

integer

required

Can be negative for an already-expired certificate.

isExpired

boolean

required

Whether valid_to is in the past.

certValidations

object

required

Show properties

selfSigned

boolean

required

true if the certificate is its own issuer.

chainComplete

boolean

required

Whether every intermediate up to a root was presented.

trustedCert

boolean

required

Whether the chain resolves to a trusted root.

commonNameValid

boolean

required

Whether the certificate’s CN matches the scanned domain.

sanValid

boolean

required

Whether the domain is covered by a Subject Alternative Name.

chainIssueDescription

string

Present only when the chain has a problem.

tlsVersion

string

required

Same value as protocol.

cipherSuite

string

required

Negotiated cipher, e.g. "TLS_AES_256_GCM_SHA384".

securityGrade

string

required

e.g. "A+", "A", "B", down to "F".

score

integer

required

0–100, the basis for securityGrade.

Errors

Status	Cause
`400`	`domain` query parameter missing
`400`	Could not connect, the domain doesn’t resolve, or the TLS handshake failed

See the full error reference for the platform-level codes (401, 402, 429) that apply to every endpoint.

curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch(
  "https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();

import requests

res = requests.get(
    "https://api.pocketutils.com/v1/ssl-scan",
    params={"domain": "example.com"},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]

{
  "success": true,
  "data": {
    "domain": "example.com",
    "port": 443,
    "protocol": "TLSv1.3",
    "certificate": {
      "subject": { "CN": "example.com" },
      "issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
      "valid_from": "2026-01-15T00:00:00.000Z",
      "valid_to": "2027-02-15T23:59:59.000Z",
      "fingerprint": "AB:CD:12:34:...",
      "fingerprint256": "12:34:AB:CD:...",
      "serialNumber": "0A1B2C3D4E5F",
      "altNames": ["example.com", "www.example.com"],
      "keySize": 2048,
      "sigalg": "RSA-SHA256"
    },
    "chain": [
      { "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
    ],
    "isValid": true,
    "daysUntilExpiry": 209,
    "isExpired": false,
    "certValidations": {
      "selfSigned": false,
      "chainComplete": true,
      "trustedCert": true,
      "commonNameValid": true,
      "sanValid": true
    },
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "securityGrade": "A+",
    "score": 97
  }
}

Getting Started

API Reference

Query parameters

Response

Errors

​Query parameters

​Response

​Errors

Query parameters

Response

Errors