SSL

GEThttps://api.deepinfo.com/v1/lookup/ssl

Connects to a host in real time and returns the SSL/TLS certificate it serves: subject, issuer, validity, fingerprints, extensions (including all DNS names in the Subject Alternative Name) and whether the signature and chain are valid.

Request

curl

curl 'https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/lookup/ssl"

params = {
    "target": "deepinfo.com"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, params=params, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Response Body

{
  "target": "deepinfo.com",
  "port": 443,
  "check_date": "2026-09-22T12:26:02Z",
  "connection_status": "success",
  "parsed": {
    "version": {
      "name": "v3",
      "value": "2"
    },
    "fingerprint_sha1": "5102c880b9f106836e519b298180d61b676159c8",
    "fingerprint_sha256": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50",
    "fingerprint_md5": "d168f284acc2bd12ef0942ca7b8437ce",
    "subject": {
      "dn": "CN=deepinfo.com",
      "common_name": "deepinfo.com",
      "country_name": null,
      "locality": null,
      "organization": null,
      "organizational_unit": null,
      "state": null
    },
    "signature": {
      "value": "MEQCIBNf/tDQrmobCrlLn6qx00hK9xB2VIsUv0js2QhljzehAiAK9Wa5vq0T/Nvr+MrtthEr/AY+sHMi+vIKZEgArZAAUg==",
      "self_signed": false,
      "valid": true,
      "valid_chain": true,
      "invalid_reason": null,
      "signature_algorithm": {
        "oid": "1.2.840.10045.4.3.2",
        "name": "sha256"
      }
    },
    "validity": {
      "start": "2026-08-22T16:13:55Z",
      "length": 7779585,
      "end": "2026-11-20T17:13:40Z"
    },
    "issuer": {
      "dn": "CN=WE1,O=Google Trust Services,C=US",
      "common_name": "WE1",
      "country_name": "US",
      "locality": null,
      "organization": "Google Trust Services",
      "organizational_unit": null,
      "state": null
    },
    "extensions": {
      "key_usage": {
        "digital_signature": true,
        "content_commitment": false,
        "key_agreement": false,
        "data_encipherment": false,
        "key_encipherment": false,
        "key_cert_sign": false,
        "crl_sign": false
      },
      "extended_key_usage": {
        "server_auth": true
      },
      "basic_constraints": {
        "is_ca": false
      },
      "subject_key_identifier": {
        "digest": "p0cCg0usJcT4dOaSGZXGwJBtEBw="
      },
      "authority_key_identifier": {
        "key_identifier": "kHeSNWfE/6jMqeZ72YB5e8yT+Tg="
      },
      "authority_info_access": {
        "caissuers_urls": "http://i.pki.goog/we1.crt"
      },
      "subject_alt_name": {
        "dns_names": [
          "deepinfo.com",
          "*.deepinfo.com"
        ]
      },
      "certificate_policies": [
        "2.23.140.1.2.1"
      ],
      "crl_distribution_points": [
        "http://c.pki.goog/we1/hxWfeVec_R4.crl"
      ],
      "signed_certificate_timestamp": [
        {
          "log_id": "wjF+V0UZo0XufzjespBB68fCIVoiv3/Vta12mtkOUs0=",
          "timestamp": 1787418836,
          "version": 0,
          "signature": "MEQCICgG2IGcayVZ+Ttkz2l/ZwOu8iCGIvPw1vmC7YzrgGizAiAcefN4O0thG7GGL8SJReLUyvnamb10T1HE4ao3Qla3xg=="
        },
        {
          "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
          "timestamp": 1787418836,
          "version": 0,
          "signature": "MEUCIQC7tTqXR/P93QDZTvumLFie/5Ic+z5tybPkmYTq948+wgIgFPm8YcnJu/CmGa9vl0sKxkiI21PTM1HmZWTA6Rkq6ts="
        }
      ],
      "other_extensions": []
    },
    "serial_number": "175099252490783179325599447426535789523",
    "tbs_fingerprint": "8fd171df12e6296f987fbb69506eb38cfbf61ce8c3afef080788b338ce96f289",
    "subject_key_info": {
      "fingerprint": {
        "hash_algorithm_name": "sha256",
        "value": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50"
      },
      "key_algorithm": {
        "name": "ECDSA"
      },
      "ecdsa_public_key": {
        "length": "256",
        "x": "21201999730139012709824012335874547273352194066646550944879963279817511306367",
        "y": "45576670326640749315426684723968379373483736538821867599901561713273067300353"
      }
    },
    "has_expired": false,
    "fqdn_list": [
      "deepinfo.com"
    ]
  },
  "certificate": "MIIDfTCCAySgAwIBAgIRAIO6460sp0mAE8qAeNMEE9MwCgYIKoZIzj0EAwIwOzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNl…",
  "parse_errors": []
}

Content-Type: application/json
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Authentication

Send your API key in the apikey request header.

Query Parameters

Parameter	Required	Description
`target`	Required	Domain name or IP address to connect to. Example`deepinfo.com`
`port`	Optional	Port to connect to. Default `443`. Example`443`
`proxy`	Optional	Optional proxy to connect through, in the form `scheme://user:password@host:port`.

Response Fields

Field	Description
`target`	The host that was checked
`port`	The port that was checked
`connection_status`	`success`, `timeout`, `refused`, `reset`, `ssl_error`, `not_resolved` or `proxy_connection_error`
`parsed`	Parsed certificate, with the `parsed.*` fields below. `null` if no certificate was retrieved
`parsed.version.name`	Certificate version, e.g. `v3`
`parsed.version.value`	The version number as encoded in the certificate (`2` for v3)
`parsed.subject.dn`	Subject distinguished name
`parsed.subject.common_name`	Subject common name (CN)
`parsed.subject.organization`	Subject organization (O)
`parsed.subject.organizational_unit`	Subject organizational unit (OU)
`parsed.subject.locality`	Subject locality (L)
`parsed.subject.state`	Subject state or province (ST)
`parsed.subject.country_name`	Subject country (C)
`parsed.issuer.dn`	Issuer distinguished name
`parsed.issuer.common_name`	Issuer common name (CN)
`parsed.issuer.organization`	Issuer organization (O)
`parsed.issuer.organizational_unit`	Issuer organizational unit (OU)
`parsed.issuer.locality`	Issuer locality (L)
`parsed.issuer.state`	Issuer state or province (ST)
`parsed.issuer.country_name`	Issuer country (C)
`parsed.validity.start`	Start of the validity period
`parsed.validity.end`	End of the validity period
`parsed.validity.length`	Length of the validity period, in seconds
`parsed.signature.valid`	Whether the signature is valid
`parsed.signature.valid_chain`	Whether the certificate chain is valid
`parsed.signature.self_signed`	Whether the certificate is self-signed
`parsed.signature.invalid_reason`	Why the signature or the chain is not valid; `null` when both are valid
`parsed.signature.value`	The signature, base64-encoded
`parsed.signature.signature_algorithm.oid`	OID of the signature algorithm
`parsed.signature.signature_algorithm.name`	Name of the signature algorithm, e.g. `sha256`
`parsed.fingerprint_sha1`	SHA-1 fingerprint of the certificate
`parsed.fingerprint_sha256`	SHA-256 fingerprint of the certificate
`parsed.fingerprint_md5`	MD5 fingerprint of the certificate
`parsed.tbs_fingerprint`	Fingerprint of the signed part of the certificate (TBS certificate)
`parsed.serial_number`	Serial number
`parsed.subject_key_info`	The certificate's public key: its algorithm, fingerprint and key parameters
`parsed.extensions`	X.509 extensions. `parsed.extensions.subject_alt_name.dns_names` holds every DNS name in the Subject Alternative Name
`parsed.has_expired`	Whether the certificate has expired
`parsed.fqdn_list`	Host names the certificate is valid for
`certificate`	The certificate in base64 (DER)
`parse_errors`	Problems found while parsing the certificate
`check_date`	When the check was performed (UTC)

Response Schema

Inferred from examples Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

Field	Type	Example
`target`	string	`"deepinfo.com"`
`port`	number	`443`
`check_date`	string	`"2026-09-22T12:26:02Z"`
`connection_status`	string	`"success"`
`parsed`	object
`parsed.version`	object
`parsed.version.name`	string	`"v3"`
`parsed.version.value`	string	`"2"`
`parsed.fingerprint_sha1`	string	`"5102c880b9f106836e519b298180d61b676…"`
`parsed.fingerprint_sha256`	string	`"12a3374625c71344dca023d3fd679c8603b…"`
`parsed.fingerprint_md5`	string	`"d168f284acc2bd12ef0942ca7b8437ce"`
`parsed.subject`	object
`parsed.subject.dn`	string	`"CN=deepinfo.com"`
`parsed.subject.common_name`	string	`"deepinfo.com"`
`parsed.subject.country_name`	null
`parsed.subject.locality`	null
`parsed.subject.organization`	null
`parsed.subject.organizational_unit`	null
`parsed.subject.state`	null
`parsed.signature`	object
`parsed.signature.value`	string	`"MEQCIBNf/tDQrmobCrlLn6qx00hK9xB2VIs…"`
`parsed.signature.self_signed`	boolean	`false`
`parsed.signature.valid`	boolean	`true`
`parsed.signature.valid_chain`	boolean	`true`
`parsed.signature.invalid_reason`	null
`parsed.signature.signature_algorithm`	object
`parsed.signature.signature_algorithm.oid`	string	`"1.2.840.10045.4.3.2"`
`parsed.signature.signature_algorithm.name`	string	`"sha256"`
`parsed.validity`	object
`parsed.validity.start`	string	`"2026-08-22T16:13:55Z"`
`parsed.validity.length`	number	`7779585`
`parsed.validity.end`	string	`"2026-11-20T17:13:40Z"`
`parsed.issuer`	object
`parsed.issuer.dn`	string	`"CN=WE1,O=Google Trust Services,C=US"`
`parsed.issuer.common_name`	string	`"WE1"`
`parsed.issuer.country_name`	string	`"US"`
`parsed.issuer.locality`	null
`parsed.issuer.organization`	string	`"Google Trust Services"`
`parsed.issuer.organizational_unit`	null
`parsed.issuer.state`	null
`parsed.extensions`	object
`parsed.extensions.key_usage`	object
`parsed.extensions.key_usage.digital_signature`	boolean	`true`
`parsed.extensions.key_usage.content_commitment`	boolean	`false`
`parsed.extensions.key_usage.key_agreement`	boolean	`false`
`parsed.extensions.key_usage.data_encipherment`	boolean	`false`
`parsed.extensions.key_usage.key_encipherment`	boolean	`false`
`parsed.extensions.key_usage.key_cert_sign`	boolean	`false`
`parsed.extensions.key_usage.crl_sign`	boolean	`false`
`parsed.extensions.extended_key_usage`	object
`parsed.extensions.extended_key_usage.server_auth`	boolean	`true`
`parsed.extensions.basic_constraints`	object
`parsed.extensions.basic_constraints.is_ca`	boolean	`false`
`parsed.extensions.subject_key_identifier`	object
`parsed.extensions.subject_key_identifier.digest`	string	`"p0cCg0usJcT4dOaSGZXGwJBtEBw="`
`parsed.extensions.authority_key_identifier`	object
`parsed.extensions.authority_key_identifier.key_identifier`	string	`"kHeSNWfE/6jMqeZ72YB5e8yT+Tg="`
`parsed.extensions.authority_info_access`	object
`parsed.extensions.authority_info_access.caissuers_urls`	string	`"http://i.pki.goog/we1.crt"`
`parsed.extensions.subject_alt_name`	object
`parsed.extensions.subject_alt_name.dns_names`	array<string>	`"deepinfo.com"`
`parsed.extensions.certificate_policies`	array<string>	`"2.23.140.1.2.1"`
`parsed.extensions.crl_distribution_points`	array<string>	`"http://c.pki.goog/we1/hxWfeVec_R4.c…"`
`parsed.extensions.signed_certificate_timestamp`	array<object>
`parsed.extensions.signed_certificate_timestamp[].log_id`	string	`"wjF+V0UZo0XufzjespBB68fCIVoiv3/Vta1…"`
`parsed.extensions.signed_certificate_timestamp[].timestamp`	number	`1787418836`
`parsed.extensions.signed_certificate_timestamp[].version`	number	`0`
`parsed.extensions.signed_certificate_timestamp[].signature`	string	`"MEQCICgG2IGcayVZ+Ttkz2l/ZwOu8iCGIvP…"`
`parsed.extensions.other_extensions`	array
`parsed.serial_number`	string	`"17509925249078317932559944742653578…"`
`parsed.tbs_fingerprint`	string	`"8fd171df12e6296f987fbb69506eb38cfbf…"`
`parsed.subject_key_info`	object
`parsed.subject_key_info.fingerprint`	object
`parsed.subject_key_info.fingerprint.hash_algorithm_name`	string	`"sha256"`
`parsed.subject_key_info.fingerprint.value`	string	`"12a3374625c71344dca023d3fd679c8603b…"`
`parsed.subject_key_info.key_algorithm`	object
`parsed.subject_key_info.key_algorithm.name`	string	`"ECDSA"`
`parsed.subject_key_info.ecdsa_public_key`	object
`parsed.subject_key_info.ecdsa_public_key.length`	string	`"256"`
`parsed.subject_key_info.ecdsa_public_key.x`	string	`"21201999730139012709824012335874547…"`
`parsed.subject_key_info.ecdsa_public_key.y`	string	`"45576670326640749315426684723968379…"`
`parsed.has_expired`	boolean	`false`
`parsed.fqdn_list`	array<string>	`"deepinfo.com"`
`certificate`	string	`"MIIDfTCCAySgAwIBAgIRAIO6460sp0mAE8q…"`
`parse_errors`	array

Errors

400 if target is missing or invalid. Connection problems are not errors: they return 200 with the reason in connection_status.

Examples

The saved example from the Deepinfo API, shown in the request and response panels.

deepinfo.com:443GET/lookup/ssl?target=deepinfo.com200 OK

Worked Examples

Worked examples of this endpoint, each on its own page with the exact request and the response it returns.

Certificate of a DomainThe certificate of deepinfo.com: issued by Google Trust Services (WE1) for deepinfo.com and *.deepinfo.com, valid, ECDSA key.
Mail Server on Port 465The certificate of smtp.gmail.com on port 465 (SMTP over TLS): issued by Google Trust Services WR2.
An Expired CertificateAn expired certificate: has_expired is true and invalid_reason says "certificate has expired" (it ended in April 2015).
A Certificate for Another Host NameA certificate for another host name: valid is false with "Hostname mismatch" for wrong.host.badssl.com.

See all examples

Reference updated September 27, 2026