Request demo

SSL Lookup API

Check the Certificate a Host Serves Right Now.

The SSL Lookup API takes a domain or IP address. It opens a TLS connection and returns the certificate the host presents, parsed: subject, issuer, validity, the names in the Subject Alternative Name, fingerprints, and a verdict on the signature and the chain.

Talk to us about access SSL reference

Request

GET /lookup/ssl?target=deepinfo.com

Response · 200 OK

  1. connection_status

    success timeout refused reset ssl_error not_resolved proxy_connection_error

  2. subject

    CN=deepinfo.com

  3. issuer

    WE1 · Google Trust Services

  4. validity

    checked 2026-09-22

    2026-08-222026-11-20

    has_expired false

  5. fqdn_list

    deepinfo.com

    • signature.valid true
    • valid_chain true
    • self_signed false

The API Parses a Live Handshake.

The response carries the certificate the host served, not its whole chain. Whether that chain validates comes back as one boolean, valid_chain, next to the signature check.

GET https://api.deepinfo.com/v1/lookup/ssl Reference
ParameterTypeDescription
targetstringRequiredA domain name or IP address to connect to, for example deepinfo.com.
portintegerOptionalThe port to connect to. Default 443.

Request

curl "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com" \
  -H "apikey: YOUR_API_KEY"

Response

200 OK · application/json 
{
  "target": "deepinfo.com",
  "port": 443,
  "connection_status": "success",
  "parsed": {
    "subject": { "dn": "CN=deepinfo.com", "common_name": "deepinfo.com", "…": "…" },
    "issuer": {
      "dn": "CN=WE1,O=Google Trust Services,C=US",
      "common_name": "WE1",
      "organization": "Google Trust Services",
      "…": "…"
    },
    "validity": {
      "start": "2026-08-22T16:13:55Z",
      "end": "2026-11-20T17:13:40Z",
      "length": 7779585
    },
    "signature": {
      "valid": true,
      "valid_chain": true,
      "self_signed": false,
      "invalid_reason": null,
      "…": "…"
    },
    "fingerprint_sha256": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50",
    "fingerprint_sha1": "…",
    "fingerprint_md5": "…",
    "has_expired": false,
    "fqdn_list": ["deepinfo.com"],
    "extensions": { "…": "key_usage, extended_key_usage, basic_constraints, …" }
  },
  "certificate": "MIIDfTCCAySgAwIBAgIR…",
  "parse_errors": [],
  "check_date": "2026-09-22T12:26:02Z"
}

What a Certificate Check Reads First.

Expiry

Validity

validity.start, validity.end and its length in seconds, plus a has_expired flag, so spotting a lapsed certificate needs no date arithmetic.

Trust

Signature and Chain

signature.valid, valid_chain and self_signed, with invalid_reason when a check fails.

Coverage

The Names It Covers

fqdn_list holds every DNS name in the Subject Alternative Name. Certificates often name hosts that no inventory lists.

Failures Come Back as Answers.

A host that refuses the connection is still a result. The call returns 200 with the reason in connection_status, so one unreachable host does not turn into an error your code has to catch.

ValueWhat happened
successConnected and read the certificate.
timeoutThe host did not answer in time.
refusedThe host refused the connection.
resetThe connection was reset.
ssl_errorThe TLS handshake failed.
not_resolvedThe name did not resolve.
proxy_connection_errorThe connection through a proxy failed.

When no certificate was retrieved, parsed is null. Problems found while parsing a certificate are listed in parse_errors.

Every call GET /lookup/ssl?target=…

200with the reason in connection_status

success

{ subject, issuer, validity, signature, … }the certificate, read

timeout refused reset ssl_error not_resolved proxy_connection_error

nullno certificate retrieved

Checks Teams Run Against Live Hosts.

Attack Surface Checks

Check what a host serves after a renewal, and catch a certificate that is about to lapse before users do.

Use case

Audit Evidence

Record the certificate a service presented, with its issuer, validity and check_date, at the moment you checked.

Use case

Phishing Triage

Read the certificate a suspicious domain presents: who issued it, when, and which other names it covers.

Use case

Beyond the Live Check.

Live vs indexedThis call reads what a host serves now. To filter across certificates the index has already seen, such as by issuer or self-signed status, use Domain Search.
The certificatecertificate holds the served certificate itself, base64-encoded DER, for your tooling.
In the Deepinfo PlatformExternal Attack Surface Management checks SSL on all assets, and a certificate change can raise a notification.
Rate limits and errorsPlan-dependent, one request per second by default. 400 when target is missing or invalid; an unreachable host is not an error. See rate limits and errors.

More Calls for One Host.

Lookup DNS The current records for a name, by type, in one call. Read Lookup Port Scan The other services a host exposes, on hosts you are authorized to test. Read Lookup Web Data Everything the page on that host reveals, in one response. Read

Questions About SSL Lookup API

Does it catch a certificate issued for another host name?

Yes. signature.valid comes back false, and invalid_reason says why, for example Hostname mismatch.

Can we find other hosts that serve the same certificate?

Take fingerprint_sha256 from the response and filter Domain Search on ssl.fingerprint.sha256. A fingerprint identifies one certificate, so the result lists the hosts in the index that serve it.

Can we check a port other than 443?

Yes. Pass port, for example 465 for a mail server that speaks SMTP over TLS.

Can we see the certificates a host served in the past?

Not through a public endpoint. For assets you monitor, External Attack Surface Management keeps a dated SSL snapshot from each scan; Historical SSL Records lists the routes to certificate data.

How is the SSL Lookup API priced?

As part of an API services plan, by volume and frequency. Each lookup counts against your plan’s quota at one unit per request. See Data & API pricing.

Check Your Hosts First.

Point the API at a handful of your own services and compare the result with what you expect them to serve. We set up access and answer schema questions on a short call.

Talk to us about access All API services