curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
-H "Authorization: Bearer YOUR_API_KEY"
const res = await fetch(
"https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
{ headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();
import requests
res = requests.get(
"https://api.pocketutils.com/v1/ssl-scan",
params={"domain": "example.com"},
headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]
{
"success": true,
"data": {
"domain": "example.com",
"port": 443,
"protocol": "TLSv1.3",
"certificate": {
"subject": { "CN": "example.com" },
"issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
"valid_from": "2026-01-15T00:00:00.000Z",
"valid_to": "2027-02-15T23:59:59.000Z",
"fingerprint": "AB:CD:12:34:...",
"fingerprint256": "12:34:AB:CD:...",
"serialNumber": "0A1B2C3D4E5F",
"altNames": ["example.com", "www.example.com"],
"keySize": 2048,
"sigalg": "RSA-SHA256"
},
"chain": [
{ "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
],
"isValid": true,
"daysUntilExpiry": 209,
"isExpired": false,
"certValidations": {
"selfSigned": false,
"chainComplete": true,
"trustedCert": true,
"commonNameValid": true,
"sanValid": true
},
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"securityGrade": "A+",
"score": 97
}
}
Site Scanning
SSL Scanner
Inspect a domain’s certificate, chain, cipher suite, and expiry window.
GET
/
v1
/
ssl-scan
curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
-H "Authorization: Bearer YOUR_API_KEY"
const res = await fetch(
"https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
{ headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();
import requests
res = requests.get(
"https://api.pocketutils.com/v1/ssl-scan",
params={"domain": "example.com"},
headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]
{
"success": true,
"data": {
"domain": "example.com",
"port": 443,
"protocol": "TLSv1.3",
"certificate": {
"subject": { "CN": "example.com" },
"issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
"valid_from": "2026-01-15T00:00:00.000Z",
"valid_to": "2027-02-15T23:59:59.000Z",
"fingerprint": "AB:CD:12:34:...",
"fingerprint256": "12:34:AB:CD:...",
"serialNumber": "0A1B2C3D4E5F",
"altNames": ["example.com", "www.example.com"],
"keySize": 2048,
"sigalg": "RSA-SHA256"
},
"chain": [
{ "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
],
"isValid": true,
"daysUntilExpiry": 209,
"isExpired": false,
"certValidations": {
"selfSigned": false,
"chainComplete": true,
"trustedCert": true,
"commonNameValid": true,
"sanValid": true
},
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"securityGrade": "A+",
"score": 97
}
}
Opens a TLS connection to the domain and inspects what it presents: the leaf certificate, the full chain, negotiated protocol version and cipher suite, and a set of validity checks (expiry, hostname match, chain completeness, trust). Rolls up into a security grade.
See the full error reference for the platform-level codes (
1 credit per call
Query parameters
string
required
Domain to scan, e.g.
example.com. No scheme or path — just the hostname.Response
boolean
required
Always
true for a 200 response.object
required
Hide properties
Hide properties
string
required
Echoes the requested domain.
integer
required
Always
443.string
required
Negotiated protocol, e.g.
"TLSv1.3".object
required
Show properties
Show properties
object
required
Certificate subject fields (
CN, O, …).object
required
Issuer fields, same shape as
subject.string
required
ISO 8601 timestamp.
string
required
ISO 8601 timestamp.
string
required
SHA-1 fingerprint.
string
required
SHA-256 fingerprint.
string
required
Certificate serial number.
array
required
Subject Alternative Names covered by this certificate.
integer
Public key size in bits, when available.
string
Signature algorithm, when available.
array
required
Intermediate and root certificates. Each entry has the same shape as
certificate, minus keySize and sigalg.boolean
required
true if the certificate passes every check below.integer
required
Can be negative for an already-expired certificate.
boolean
required
Whether
valid_to is in the past.object
required
Show properties
Show properties
boolean
required
true if the certificate is its own issuer.boolean
required
Whether every intermediate up to a root was presented.
boolean
required
Whether the chain resolves to a trusted root.
boolean
required
Whether the certificate’s CN matches the scanned domain.
boolean
required
Whether the domain is covered by a Subject Alternative Name.
string
Present only when the chain has a problem.
string
required
Same value as
protocol.string
required
Negotiated cipher, e.g.
"TLS_AES_256_GCM_SHA384".string
required
e.g.
"A+", "A", "B", down to "F".integer
required
0–100, the basis for
securityGrade.Errors
| Status | Cause |
|---|---|
400 | domain query parameter missing |
400 | Could not connect, the domain doesn’t resolve, or the TLS handshake failed |
401, 402, 429) that apply to every endpoint.
curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
-H "Authorization: Bearer YOUR_API_KEY"
const res = await fetch(
"https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
{ headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();
import requests
res = requests.get(
"https://api.pocketutils.com/v1/ssl-scan",
params={"domain": "example.com"},
headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]
{
"success": true,
"data": {
"domain": "example.com",
"port": 443,
"protocol": "TLSv1.3",
"certificate": {
"subject": { "CN": "example.com" },
"issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
"valid_from": "2026-01-15T00:00:00.000Z",
"valid_to": "2027-02-15T23:59:59.000Z",
"fingerprint": "AB:CD:12:34:...",
"fingerprint256": "12:34:AB:CD:...",
"serialNumber": "0A1B2C3D4E5F",
"altNames": ["example.com", "www.example.com"],
"keySize": 2048,
"sigalg": "RSA-SHA256"
},
"chain": [
{ "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
],
"isValid": true,
"daysUntilExpiry": 209,
"isExpired": false,
"certValidations": {
"selfSigned": false,
"chainComplete": true,
"trustedCert": true,
"commonNameValid": true,
"sanValid": true
},
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_256_GCM_SHA384",
"securityGrade": "A+",
"score": 97
}
}
Was this page helpful?
⌘I