# SSL Lookup API URL: https://www.deepinfo.com/data-api/apis/ssl-lookup/ ## Check the Certificate a Host Serves Right Now. The SSL Lookup API takes a domain or IP address. It opens a TLS connection and returns the certificate the host presents, parsed: subject, issuer, validity, the names in the Subject Alternative Name, fingerprints, and a verdict on the signature and the chain. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [SSL reference](https://docs.deepinfo.com/reference/lookup/ssl/) ### The API Parses a Live Handshake. The response carries the certificate the host served, not its whole chain. Whether that chain validates comes back as one boolean, `valid_chain`, next to the signature check. GET `https://api.deepinfo.com/v1/lookup/ssl` [Reference](https://docs.deepinfo.com/reference/lookup/ssl/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `target` | string | Required | A domain name or IP address to connect to, for example `deepinfo.com`. | | `port` | integer | Optional | The port to connect to. Default `443`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/lookup/ssl", params={"target": "deepinfo.com"}, headers={"apikey": "YOUR_API_KEY"}, ) cert = r.json()["parsed"] print(cert["validity"]["end"], cert["signature"]["valid_chain"]) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com', { headers: { apikey: 'YOUR_API_KEY' } } ) const { connection_status, parsed } = await r.json() console.log(connection_status, parsed?.validity.end) ``` Response 200 OK · application/json ```json { "target": "deepinfo.com", "port": 443, "connection_status": "success", "parsed": { "subject": { "dn": "CN=deepinfo.com", "common_name": "deepinfo.com", "…": "…" }, "issuer": { "dn": "CN=WE1,O=Google Trust Services,C=US", "common_name": "WE1", "organization": "Google Trust Services", "…": "…" }, "validity": { "start": "2026-08-22T16:13:55Z", "end": "2026-11-20T17:13:40Z", "length": 7779585 }, "signature": { "valid": true, "valid_chain": true, "self_signed": false, "invalid_reason": null, "…": "…" }, "fingerprint_sha256": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50", "fingerprint_sha1": "…", "fingerprint_md5": "…", "has_expired": false, "fqdn_list": ["deepinfo.com"], "extensions": { "…": "key_usage, extended_key_usage, basic_constraints, …" } }, "certificate": "MIIDfTCCAySgAwIBAgIR…", "parse_errors": [], "check_date": "2026-09-22T12:26:02Z" } ``` ### What a Certificate Check Reads First. Expiry #### Validity `validity.start`, `validity.end` and its length in seconds, plus a `has_expired` flag, so spotting a lapsed certificate needs no date arithmetic. Trust #### Signature and Chain `signature.valid`, `valid_chain` and `self_signed`, with `invalid_reason` when a check fails. Coverage #### The Names It Covers `fqdn_list` holds every DNS name in the Subject Alternative Name. Certificates often name hosts that no inventory lists. ### Failures Come Back as Answers. A host that refuses the connection is still a result. The call returns `200` with the reason in `connection_status`, so one unreachable host does not turn into an error your code has to catch. | Value | What happened | | --- | --- | | `success` | Connected and read the certificate. | | `timeout` | The host did not answer in time. | | `refused` | The host refused the connection. | | `reset` | The connection was reset. | | `ssl_error` | The TLS handshake failed. | | `not_resolved` | The name did not resolve. | | `proxy_connection_error` | The connection through a proxy failed. | When no certificate was retrieved, `parsed` is `null`. Problems found while parsing a certificate are listed in `parse_errors`. ### Checks Teams Run Against Live Hosts. #### [Attack Surface Checks](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/) Check what a host serves after a renewal, and catch a certificate that is about to lapse before users do. #### [Audit Evidence](https://www.deepinfo.com/solutions/use-cases/compliance-and-audit-readiness/) Record the certificate a service presented, with its issuer, validity and `check_date`, at the moment you checked. #### [Phishing Triage](https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/) Read the certificate a suspicious domain presents: who issued it, when, and which other names it covers. ### Beyond the Live Check. - **Live vs indexed**: This call reads what a host serves now. To filter across certificates the index has already seen, such as by issuer or self-signed status, use [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/). - **The certificate**: `certificate` holds the served certificate itself, base64-encoded DER, for your tooling. - **In the Deepinfo Platform**: [External Attack Surface Management](https://www.deepinfo.com/platform/easm/continuous-scanning/) checks SSL on all assets, and a certificate change can raise a notification. - **Rate limits and errors**: Plan-dependent, one request per second by default. `400` when `target` is missing or invalid; an unreachable host is not an error. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/) and [errors](https://docs.deepinfo.com/getting-started/errors/). ### More Calls for One Host. - [DNS](https://www.deepinfo.com/data-api/apis/dns-lookup/) (Lookup): The current records for a name, by type, in one call. - [Port Scan](https://www.deepinfo.com/data-api/apis/port-scan/) (Lookup): The other services a host exposes, on hosts you are authorized to test. - [Web Data](https://www.deepinfo.com/data-api/apis/webdata-lookup/) (Lookup): Everything the page on that host reveals, in one response. ### Questions About SSL Lookup API **Does it catch a certificate issued for another host name?** Yes. `signature.valid` comes back `false`, and `invalid_reason` says why, for example `Hostname mismatch`. **Can we find other hosts that serve the same certificate?** Take `fingerprint_sha256` from the response and filter [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) on `ssl.fingerprint.sha256`. A fingerprint identifies one certificate, so the result lists the hosts in the index that serve it. **Can we check a port other than 443?** Yes. Pass `port`, for example `465` for a mail server that speaks SMTP over TLS. **Can we see the certificates a host served in the past?** Not through a public endpoint. For assets you monitor, External Attack Surface Management keeps a dated SSL snapshot from each scan; [Historical SSL Records](https://www.deepinfo.com/data-api/feeds/historical-ssl-records/) lists the routes to certificate data. **How is the SSL Lookup API priced?** As part of an API services plan, by volume and frequency. Each lookup counts against your plan’s quota at one unit per request. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). ### Check Your Hosts First. Point the API at a handful of your own services and compare the result with what you expect them to serve. We set up access and answer schema questions on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)