# SSL GET /lookup/ssl: Connects to a host in real time and returns the SSL/TLS certificate it serves: subject, issuer, validity, fingerprints, extensions (including… Source: https://docs.deepinfo.com/reference/lookup/ssl/ Last updated: 2026-09-27 --- `GET https://api.deepinfo.com/v1/lookup/ssl` Connects to a host in real time and returns the SSL/TLS certificate it serves: subject, issuer, validity, fingerprints, extensions (including all DNS names in the Subject Alternative Name) and whether the signature and chain are valid. ## Authentication Send your API key in the `apikey` request header. ## Query Parameters | Parameter | Required | Description | Example | |---|---|---|---| | `target` | Required | Domain name or IP address to connect to. | `deepinfo.com` | | `port` | Optional | Port to connect to. Default `443`. | `443` | | `proxy` | Optional | Optional proxy to connect through, in the form `scheme://user:password@host:port`. | | ## Response Fields | Field | Description | |---|---| | `target` | The host that was checked | | `port` | The port that was checked | | `connection_status` | `success`, `timeout`, `refused`, `reset`, `ssl_error`, `not_resolved` or `proxy_connection_error` | | `parsed` | Parsed certificate, with the `parsed.*` fields below. `null` if no certificate was retrieved | | `parsed.version.name` | Certificate version, e.g. `v3` | | `parsed.version.value` | The version number as encoded in the certificate (`2` for v3) | | `parsed.subject.dn` | Subject distinguished name | | `parsed.subject.common_name` | Subject common name (CN) | | `parsed.subject.organization` | Subject organization (O) | | `parsed.subject.organizational_unit` | Subject organizational unit (OU) | | `parsed.subject.locality` | Subject locality (L) | | `parsed.subject.state` | Subject state or province (ST) | | `parsed.subject.country_name` | Subject country (C) | | `parsed.issuer.dn` | Issuer distinguished name | | `parsed.issuer.common_name` | Issuer common name (CN) | | `parsed.issuer.organization` | Issuer organization (O) | | `parsed.issuer.organizational_unit` | Issuer organizational unit (OU) | | `parsed.issuer.locality` | Issuer locality (L) | | `parsed.issuer.state` | Issuer state or province (ST) | | `parsed.issuer.country_name` | Issuer country (C) | | `parsed.validity.start` | Start of the validity period | | `parsed.validity.end` | End of the validity period | | `parsed.validity.length` | Length of the validity period, in seconds | | `parsed.signature.valid` | Whether the signature is valid | | `parsed.signature.valid_chain` | Whether the certificate chain is valid | | `parsed.signature.self_signed` | Whether the certificate is self-signed | | `parsed.signature.invalid_reason` | Why the signature or the chain is not valid; `null` when both are valid | | `parsed.signature.value` | The signature, base64-encoded | | `parsed.signature.signature_algorithm.oid` | OID of the signature algorithm | | `parsed.signature.signature_algorithm.name` | Name of the signature algorithm, e.g. `sha256` | | `parsed.fingerprint_sha1` | SHA-1 fingerprint of the certificate | | `parsed.fingerprint_sha256` | SHA-256 fingerprint of the certificate | | `parsed.fingerprint_md5` | MD5 fingerprint of the certificate | | `parsed.tbs_fingerprint` | Fingerprint of the signed part of the certificate (TBS certificate) | | `parsed.serial_number` | Serial number | | `parsed.subject_key_info` | The certificate's public key: its algorithm, fingerprint and key parameters | | `parsed.extensions` | X.509 extensions. `parsed.extensions.subject_alt_name.dns_names` holds every DNS name in the Subject Alternative Name | | `parsed.has_expired` | Whether the certificate has expired | | `parsed.fqdn_list` | Host names the certificate is valid for | | `certificate` | The certificate in base64 (DER) | | `parse_errors` | Problems found while parsing the certificate | | `check_date` | When the check was performed (UTC) | ## Response Schema _Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. | Field | Type | |---|---| | `target` | string | | `port` | number | | `check_date` | string | | `connection_status` | string | | `parsed` | object | | `parsed.version` | object | | `parsed.version.name` | string | | `parsed.version.value` | string | | `parsed.fingerprint_sha1` | string | | `parsed.fingerprint_sha256` | string | | `parsed.fingerprint_md5` | string | | `parsed.subject` | object | | `parsed.subject.dn` | string | | `parsed.subject.common_name` | string | | `parsed.subject.country_name` | null | | `parsed.subject.locality` | null | | `parsed.subject.organization` | null | | `parsed.subject.organizational_unit` | null | | `parsed.subject.state` | null | | `parsed.signature` | object | | `parsed.signature.value` | string | | `parsed.signature.self_signed` | boolean | | `parsed.signature.valid` | boolean | | `parsed.signature.valid_chain` | boolean | | `parsed.signature.invalid_reason` | null | | `parsed.signature.signature_algorithm` | object | | `parsed.signature.signature_algorithm.oid` | string | | `parsed.signature.signature_algorithm.name` | string | | `parsed.validity` | object | | `parsed.validity.start` | string | | `parsed.validity.length` | number | | `parsed.validity.end` | string | | `parsed.issuer` | object | | `parsed.issuer.dn` | string | | `parsed.issuer.common_name` | string | | `parsed.issuer.country_name` | string | | `parsed.issuer.locality` | null | | `parsed.issuer.organization` | string | | `parsed.issuer.organizational_unit` | null | | `parsed.issuer.state` | null | | `parsed.extensions` | object | | `parsed.extensions.key_usage` | object | | `parsed.extensions.key_usage.digital_signature` | boolean | | `parsed.extensions.key_usage.content_commitment` | boolean | | `parsed.extensions.key_usage.key_agreement` | boolean | | `parsed.extensions.key_usage.data_encipherment` | boolean | | `parsed.extensions.key_usage.key_encipherment` | boolean | | `parsed.extensions.key_usage.key_cert_sign` | boolean | | `parsed.extensions.key_usage.crl_sign` | boolean | | `parsed.extensions.extended_key_usage` | object | | `parsed.extensions.extended_key_usage.server_auth` | boolean | | `parsed.extensions.basic_constraints` | object | | `parsed.extensions.basic_constraints.is_ca` | boolean | | `parsed.extensions.subject_key_identifier` | object | | `parsed.extensions.subject_key_identifier.digest` | string | | `parsed.extensions.authority_key_identifier` | object | | `parsed.extensions.authority_key_identifier.key_identifier` | string | | `parsed.extensions.authority_info_access` | object | | `parsed.extensions.authority_info_access.caissuers_urls` | string | | `parsed.extensions.subject_alt_name` | object | | `parsed.extensions.subject_alt_name.dns_names` | array | | `parsed.extensions.certificate_policies` | array | | `parsed.extensions.crl_distribution_points` | array | | `parsed.extensions.signed_certificate_timestamp` | array | | `parsed.extensions.signed_certificate_timestamp[].log_id` | string | | `parsed.extensions.signed_certificate_timestamp[].timestamp` | number | | `parsed.extensions.signed_certificate_timestamp[].version` | number | | `parsed.extensions.signed_certificate_timestamp[].signature` | string | | `parsed.extensions.other_extensions` | array | | `parsed.serial_number` | string | | `parsed.tbs_fingerprint` | string | | `parsed.subject_key_info` | object | | `parsed.subject_key_info.fingerprint` | object | | `parsed.subject_key_info.fingerprint.hash_algorithm_name` | string | | `parsed.subject_key_info.fingerprint.value` | string | | `parsed.subject_key_info.key_algorithm` | object | | `parsed.subject_key_info.key_algorithm.name` | string | | `parsed.subject_key_info.ecdsa_public_key` | object | | `parsed.subject_key_info.ecdsa_public_key.length` | string | | `parsed.subject_key_info.ecdsa_public_key.x` | string | | `parsed.subject_key_info.ecdsa_public_key.y` | string | | `parsed.has_expired` | boolean | | `parsed.fqdn_list` | array | | `certificate` | string | | `parse_errors` | array | ## Errors `400` if `target` is missing or invalid. Connection problems are **not** errors: they return `200` with the reason in `connection_status`. ## Examples ### 200 · deepinfo.com:443 ```bash curl 'https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' ``` `Content-Type: application/json` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "target": "deepinfo.com", "port": 443, "check_date": "2026-09-22T12:26:02Z", "connection_status": "success", "parsed": { "version": { "name": "v3", "value": "2" }, "fingerprint_sha1": "5102c880b9f106836e519b298180d61b676159c8", "fingerprint_sha256": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50", "fingerprint_md5": "d168f284acc2bd12ef0942ca7b8437ce", "subject": { "dn": "CN=deepinfo.com", "common_name": "deepinfo.com", "country_name": null, "locality": null, "organization": null, "organizational_unit": null, "state": null }, "signature": { "value": "MEQCIBNf/tDQrmobCrlLn6qx00hK9xB2VIsUv0js2QhljzehAiAK9Wa5vq0T/Nvr+MrtthEr/AY+sHMi+vIKZEgArZAAUg==", "self_signed": false, "valid": true, "valid_chain": true, "invalid_reason": null, "signature_algorithm": { "oid": "1.2.840.10045.4.3.2", "name": "sha256" } }, "validity": { "start": "2026-08-22T16:13:55Z", "length": 7779585, "end": "2026-11-20T17:13:40Z" }, "issuer": { "dn": "CN=WE1,O=Google Trust Services,C=US", "common_name": "WE1", "country_name": "US", "locality": null, "organization": "Google Trust Services", "organizational_unit": null, "state": null }, "extensions": { "key_usage": { "digital_signature": true, "content_commitment": false, "key_agreement": false, "data_encipherment": false, "key_encipherment": false, "key_cert_sign": false, "crl_sign": false }, "extended_key_usage": { "server_auth": true }, "basic_constraints": { "is_ca": false }, "subject_key_identifier": { "digest": "p0cCg0usJcT4dOaSGZXGwJBtEBw=" }, "authority_key_identifier": { "key_identifier": "kHeSNWfE/6jMqeZ72YB5e8yT+Tg=" }, "authority_info_access": { "caissuers_urls": "http://i.pki.goog/we1.crt" }, "subject_alt_name": { "dns_names": [ "deepinfo.com", "*.deepinfo.com" ] }, "certificate_policies": [ "2.23.140.1.2.1" ], "crl_distribution_points": [ "http://c.pki.goog/we1/hxWfeVec_R4.crl" ], "signed_certificate_timestamp": [ { "log_id": "wjF+V0UZo0XufzjespBB68fCIVoiv3/Vta12mtkOUs0=", "timestamp": 1787418836, "version": 0, "signature": "MEQCICgG2IGcayVZ+Ttkz2l/ZwOu8iCGIvPw1vmC7YzrgGizAiAcefN4O0thG7GGL8SJReLUyvnamb10T1HE4ao3Qla3xg==" }, { "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "timestamp": 1787418836, "version": 0, "signature": "MEUCIQC7tTqXR/P93QDZTvumLFie/5Ic+z5tybPkmYTq948+wgIgFPm8YcnJu/CmGa9vl0sKxkiI21PTM1HmZWTA6Rkq6ts=" } ], "other_extensions": [] }, "serial_number": "175099252490783179325599447426535789523", "tbs_fingerprint": "8fd171df12e6296f987fbb69506eb38cfbf61ce8c3afef080788b338ce96f289", "subject_key_info": { "fingerprint": { "hash_algorithm_name": "sha256", "value": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50" }, "key_algorithm": { "name": "ECDSA" }, "ecdsa_public_key": { "length": "256", "x": "21201999730139012709824012335874547273352194066646550944879963279817511306367", "y": "45576670326640749315426684723968379373483736538821867599901561713273067300353" } }, "has_expired": false, "fqdn_list": [ "deepinfo.com" ] }, "certificate": "MIIDfTCCAySgAwIBAgIRAIO6460sp0mAE8qAeNMEE9MwCgYIKoZIzj0EAwIwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNl…", "parse_errors": [] } ``` ## Worked Examples Worked examples of this endpoint, each on its own page with the exact request and its response: [SSL Certificate Examples](/reference/lookup/ssl/examples/). - [Certificate of a Domain](/reference/lookup/ssl/examples/domain/): The certificate of deepinfo.com: issued by Google Trust Services (WE1) for deepinfo.com and *.deepinfo.com, valid, ECDSA key. - [Mail Server on Port 465](/reference/lookup/ssl/examples/port-465/): The certificate of smtp.gmail.com on port 465 (SMTP over TLS): issued by Google Trust Services WR2. - [An Expired Certificate](/reference/lookup/ssl/examples/expired/): An expired certificate: has_expired is true and invalid_reason says "certificate has expired" (it ended in April 2015). - [A Certificate for Another Host Name](/reference/lookup/ssl/examples/wrong-host/): A certificate for another host name: valid is false with "Hostname mismatch" for wrong.host.badssl.com.