# Historical SSL Records

URL: https://www.deepinfo.com/data-api/feeds/historical-ssl-records/

## Where Certificate Data Reaches Your Team Today.

There is no public feed of historical SSL records. Certificate data reaches your team three ways today: a live check of one host, a search of the index by certificate field, and the full record of one domain. For certificate history in bulk, talk to our data team.

[Talk to our data team](https://www.deepinfo.com/contact/?topic=data-api) [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/)

### The Routes to Certificate Data.

- **SSL Lookup**: The certificate a host serves right now: subject, issuer, validity, the SAN names, fingerprints, and a verdict on signature and chain. [`/lookup/ssl`](https://www.deepinfo.com/data-api/apis/ssl-lookup/)
- **Domain Search**: Domains filtered by certificate fields, combined with any of the other searchable fields. [`/discovery/domain-search`](https://www.deepinfo.com/data-api/apis/domain-search/)
- **Domain Detail**: The certificate on record for one domain, next to its WHOIS, DNS and web data. [`/discovery/domain-detail`](https://www.deepinfo.com/data-api/apis/domain-detail/)
- **Continuous Scanning**: A dated SSL snapshot from each scan of the assets you monitor, in [External Attack Surface Management](https://www.deepinfo.com/platform/easm/continuous-scanning/).
- **Fraudulent Domain Monitoring**: The SSL history of each lookalike domain your team monitors, in [Brand Risk Protection](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/).

Paths are relative to `https://api.deepinfo.com/v1`. Which routes your plan includes depends on your modules.

### SSL Lookup Reads the Certificate a Host Serves Right Now.

SSL Lookup opens a TLS connection and parses the certificate the host presents. It returns that certificate and a `valid_chain` verdict, not the whole chain.

Run it on a schedule against the hosts you care about and store the answers, and you are building a certificate history for those hosts from today.

[SSL reference](https://docs.deepinfo.com/reference/lookup/ssl/)

Response:

```json
{
  "target": "deepinfo.com",
  "port": 443,
  "connection_status": "success",
  "parsed": {
    "subject": { "common_name": "deepinfo.com", "…": "…" },
    "issuer": {
      "common_name": "WE1",
      "organization": "Google Trust Services",
      "…": "…"
    },
    "validity": {
      "start": "2026-08-22T16:13:55Z",
      "end": "2026-11-20T17:13:40Z"
    },
    "signature": { "valid": true, "valid_chain": true },
    "…": "…"
  }
}
```

Request:

```bash
curl "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com" \
  -H "apikey: YOUR_API_KEY"
```

### Work That Spans Many Hosts at Once.

#### [Brand Impersonation](https://www.deepinfo.com/solutions/use-cases/brand-impersonation-protection/)

Cluster lookalike infrastructure by the names its certificates cover and the issuers it uses.

#### [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/)

Find certificates that name your domains on hosts your inventory does not list.

#### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/)

Establish which certificate a host presented around the time of an incident.

#### [Supply Chain Security](https://www.deepinfo.com/solutions/use-cases/supply-chain-security/)

Review certificate hygiene across the hosts of many suppliers at once.

### Other Routes Into History.

- [Historical DNS Records](https://www.deepinfo.com/data-api/feeds/historical-dns-records/) (History): The values a domain has resolved to, and when.
- [Historical WHOIS Records](https://www.deepinfo.com/data-api/feeds/historical-whois-records/) (History): Each distinct registration record of a domain, with dates.
- [SSL Lookup](https://www.deepinfo.com/data-api/apis/ssl-lookup/) (API): The certificate a host serves, checked live.

### Questions About Historical SSL Records

**Is there an SSL history API?**

Not among the public Data & API endpoints. SSL Lookup checks a host live, and Domain Search and Domain Detail read the certificates in the index. For the assets you monitor, the Deepinfo Platform keeps a dated SSL snapshot from every scan.

**Does SSL Lookup return the full certificate chain?**

No. It returns the certificate the host serves and a `valid_chain` verdict on whether the chain validates, next to the signature check.

**Can we find the hosts that serve one certificate?**

Yes. Filter [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) on `ssl.fingerprint.sha256`. A fingerprint identifies one certificate, so the result lists the hosts in the index that serve it.

**Can we tell when a host’s certificate last changed?**

For hosts in the index, yes. Each record carries `ssl_last_change_date`, the last time Deepinfo saw its certificate change, and Domain Search can sort on it to show the latest changes first.

**What should we bring to the data team?**

Tell our data team which domains or hosts, which period and which certificate fields your analysis needs, and how your team loads data. They tell you what can be provided, and in what form.

### Bring Your Certificate Question to Our Data Team.

Name the hosts, the period and the fields you need. Our data team tells you what can be provided, and in what form.

[Talk to our data team](https://www.deepinfo.com/contact/?topic=data-api) [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/)