SSL Scanner

curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch(
  "https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();

import requests

res = requests.get(
    "https://api.pocketutils.com/v1/ssl-scan",
    params={"domain": "example.com"},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]

{
  "success": true,
  "data": {
    "domain": "example.com",
    "port": 443,
    "protocol": "TLSv1.3",
    "certificate": {
      "subject": { "CN": "example.com" },
      "issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
      "valid_from": "2026-01-15T00:00:00.000Z",
      "valid_to": "2027-02-15T23:59:59.000Z",
      "fingerprint": "AB:CD:12:34:...",
      "fingerprint256": "12:34:AB:CD:...",
      "serialNumber": "0A1B2C3D4E5F",
      "altNames": ["example.com", "www.example.com"],
      "keySize": 2048,
      "sigalg": "RSA-SHA256"
    },
    "chain": [
      { "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
    ],
    "isValid": true,
    "daysUntilExpiry": 209,
    "isExpired": false,
    "certValidations": {
      "selfSigned": false,
      "chainComplete": true,
      "trustedCert": true,
      "commonNameValid": true,
      "sanValid": true
    },
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "securityGrade": "A+",
    "score": 97
  }
}

GET

ssl-scan

curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch(
  "https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();

import requests

res = requests.get(
    "https://api.pocketutils.com/v1/ssl-scan",
    params={"domain": "example.com"},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]

{
  "success": true,
  "data": {
    "domain": "example.com",
    "port": 443,
    "protocol": "TLSv1.3",
    "certificate": {
      "subject": { "CN": "example.com" },
      "issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
      "valid_from": "2026-01-15T00:00:00.000Z",
      "valid_to": "2027-02-15T23:59:59.000Z",
      "fingerprint": "AB:CD:12:34:...",
      "fingerprint256": "12:34:AB:CD:...",
      "serialNumber": "0A1B2C3D4E5F",
      "altNames": ["example.com", "www.example.com"],
      "keySize": 2048,
      "sigalg": "RSA-SHA256"
    },
    "chain": [
      { "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
    ],
    "isValid": true,
    "daysUntilExpiry": 209,
    "isExpired": false,
    "certValidations": {
      "selfSigned": false,
      "chainComplete": true,
      "trustedCert": true,
      "commonNameValid": true,
      "sanValid": true
    },
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "securityGrade": "A+",
    "score": 97
  }
}

Opens a TLS connection to the domain and inspects what it presents: the leaf certificate, the full chain, negotiated protocol version and cipher suite, and a set of validity checks (expiry, hostname match, chain completeness, trust). Rolls up into a security grade.

1 credit per call

Query parameters

string

required

Domain to scan, e.g. example.com. No scheme or path — just the hostname.

Response

boolean

required

Always true for a 200 response.

object

required

Hide properties

string

required

Echoes the requested domain.

integer

required

Always 443.

string

required

Negotiated protocol, e.g. "TLSv1.3".

object

required

Show properties

object

required

Certificate subject fields (CN, O, …).

object

required

Issuer fields, same shape as subject.

string

required

ISO 8601 timestamp.

string

required

ISO 8601 timestamp.

string

required

SHA-1 fingerprint.

string

required

SHA-256 fingerprint.

string

required

Certificate serial number.

array

required

Subject Alternative Names covered by this certificate.

integer

Public key size in bits, when available.

string

Signature algorithm, when available.

array

required

Intermediate and root certificates. Each entry has the same shape as certificate, minus keySize and sigalg.

boolean

required

true if the certificate passes every check below.

integer

required

Can be negative for an already-expired certificate.

boolean

required

Whether valid_to is in the past.

object

required

Show properties

boolean

required

true if the certificate is its own issuer.

boolean

required

Whether every intermediate up to a root was presented.

boolean

required

Whether the chain resolves to a trusted root.

boolean

required

Whether the certificate’s CN matches the scanned domain.

boolean

required

Whether the domain is covered by a Subject Alternative Name.

string

Present only when the chain has a problem.

string

required

Same value as protocol.

string

required

Negotiated cipher, e.g. "TLS_AES_256_GCM_SHA384".

string

required

e.g. "A+", "A", "B", down to "F".

integer

required

0–100, the basis for securityGrade.

Errors

Status	Cause
`400`	`domain` query parameter missing
`400`	Could not connect, the domain doesn’t resolve, or the TLS handshake failed

See the full error reference for the platform-level codes (401, 402, 429) that apply to every endpoint.

curl "https://api.pocketutils.com/v1/ssl-scan?domain=example.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch(
  "https://api.pocketutils.com/v1/ssl-scan?domain=example.com",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } },
);
const { data } = await res.json();

import requests

res = requests.get(
    "https://api.pocketutils.com/v1/ssl-scan",
    params={"domain": "example.com"},
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = res.json()["data"]

{
  "success": true,
  "data": {
    "domain": "example.com",
    "port": 443,
    "protocol": "TLSv1.3",
    "certificate": {
      "subject": { "CN": "example.com" },
      "issuer": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1", "O": "DigiCert Inc" },
      "valid_from": "2026-01-15T00:00:00.000Z",
      "valid_to": "2027-02-15T23:59:59.000Z",
      "fingerprint": "AB:CD:12:34:...",
      "fingerprint256": "12:34:AB:CD:...",
      "serialNumber": "0A1B2C3D4E5F",
      "altNames": ["example.com", "www.example.com"],
      "keySize": 2048,
      "sigalg": "RSA-SHA256"
    },
    "chain": [
      { "subject": { "CN": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" }, "issuer": { "CN": "DigiCert Global Root G2" }, "valid_from": "2021-04-14T00:00:00.000Z", "valid_to": "2031-04-13T23:59:59.000Z", "fingerprint": "...", "fingerprint256": "...", "serialNumber": "..." }
    ],
    "isValid": true,
    "daysUntilExpiry": 209,
    "isExpired": false,
    "certValidations": {
      "selfSigned": false,
      "chainComplete": true,
      "trustedCert": true,
      "commonNameValid": true,
      "sanValid": true
    },
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_256_GCM_SHA384",
    "securityGrade": "A+",
    "score": 97
  }
}

Getting Started

API Reference

Query parameters

Response

Errors