# A Self-Signed Certificate

A self-signed certificate: issuer equals subject, self_signed is true and invalid_reason says "self-signed certificate".

Source: https://docs.deepinfo.com/reference/lookup/ssl/examples/self-signed/

Last updated: 2026-09-24

---
`GET https://api.deepinfo.com/v1/lookup/ssl?target=self-signed.badssl.com`

A self-signed certificate: issuer equals subject, self_signed is true and invalid_reason says "self-signed certificate".

Example 2 of 4 in **Certificate Problems** · [SSL Certificate Examples](/reference/lookup/ssl/examples/) · endpoint: [SSL](/reference/lookup/ssl/)

Tags: `param` `target` · `value` `self-signed.badssl.com`

Asks for the certificate of `self-signed.badssl.com`.

`issuer.dn` and `subject.dn` are the same (`CN=*.badssl.com,O=BadSSL,L=San Francisco,ST=California,C=US`): the certificate signs itself. `signature.self_signed` is `true`, `signature.valid` is `false` and `invalid_reason` is `self-signed certificate`, although the certificate has not expired.

## Request

| Parameter | In | Value |
|---|---|---|
| `target` | query | `self-signed.badssl.com` |

```bash
curl 'https://api.deepinfo.com/v1/lookup/ssl?target=self-signed.badssl.com' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'
```

## Response

### 200 · OK

`Content-Type: application/json` · `ratelimit-limit: 100` · `ratelimit-remaining: 94` · `ratelimit-reset: 3` · `x-ratelimit-limit-minute: 100` · `x-ratelimit-remaining-minute: 94` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a`

```json
{
  "target": "self-signed.badssl.com",
  "port": 443,
  "check_date": "2026-09-24T07:51:58Z",
  "connection_status": "success",
  "parsed": {
    "version": {
      "name": "v3",
      "value": "2"
    },
    "fingerprint_sha1": "f5204d2606d7f4364bb50de4b94a51446858d636",
    "fingerprint_sha256": "12494dfd35483634c566c979d0693bca0c578fd5eb44ef41f35cd6b0adb9a152",
    "fingerprint_md5": "d6a9a4eb76f327b8dac9475914c0b6ca",
    "subject": {
      "dn": "CN=*.badssl.com,O=BadSSL,L=San Francisco,ST=California,C=US",
      "common_name": "*.badssl.com",
      "country_name": "US",
      "locality": "San Francisco",
      "organization": "BadSSL",
      "organizational_unit": null,
      "state": "California"
    },
    "signature": {
      "value": "lhKr4CpXu1Tnehc9iogIPbMf1nmYp8iiz/3iAcM/y8GciwKuE8pquVvww4Q0PVIDyJ5x3DrYPmQY/IivIdIXlhWObWGISH7u5WlGzua6Ghc5wgKgGcyw8fB8xEL40iK5Y2j7Gj0PTTUHeyNO4FB+psnP9TC2rZ/ibI4gjJUg+gnxJbJABhSnSv5HomQ2kJInA95M6726bAvGBGK8dUWl16yvdgivOFaUipAOlEQ7leqCwT8aq6HtqCAJDdJq6lVa7Dj5GaUa2hYorvckLWtOJ6vqVrlahLla5smXQa1KU6QgbaHwUyNkdlBhQ8NautPvqrgPb0d0+/RtVaUUkiTj/w==",
      "self_signed": true,
      "valid": false,
      "valid_chain": true,
      "invalid_reason": "self-signed certificate",
      "signature_algorithm": {
        "oid": "1.2.840.113549.1.1.11",
        "name": "sha256"
      }
    },
    "validity": {
      "start": "2026-09-22T21:00:16Z",
      "length": 63072000,
      "end": "2028-09-21T21:00:16Z"
    },
    "issuer": {
      "dn": "CN=*.badssl.com,O=BadSSL,L=San Francisco,ST=California,C=US",
      "common_name": "*.badssl.com",
      "country_name": "US",
      "locality": "San Francisco",
      "organization": "BadSSL",
      "organizational_unit": null,
      "state": "California"
    },
    "extensions": {
      "key_usage": null,
      "extended_key_usage": null,
      "basic_constraints": {
        "is_ca": false
      },
      "subject_key_identifier": null,
      "authority_key_identifier": null,
      "authority_info_access": null,
      "subject_alt_name": {
        "dns_names": [
          "*.badssl.com",
          "badssl.com"
        ]
      },
      "certificate_policies": [],
      "crl_distribution_points": [],
      "signed_certificate_timestamp": [],
      "other_extensions": []
    },
    "serial_number": "11936345938078622338",
    "tbs_fingerprint": "dcad8d34dc92932b864cb6c98758c636522931d7cc00d427f8cfb2484697a229",
    "subject_key_info": {
      "fingerprint": {
        "hash_algorithm_name": "sha256",
        "value": "12494dfd35483634c566c979d0693bca0c578fd5eb44ef41f35cd6b0adb9a152"
      },
      "key_algorithm": {
        "name": "RSA"
      },
      "rsa_public_key": {
        "length": "2048",
        "modulus": "c204ecf88cee04c2b3d850d57058cc9318eb5ca86849b022b5f9959eb12b2c763e6cc04b604c4ceab2b4c00f80b6b0f972c98602f95c415d132b7f71c44bbce9942e5037a6671c618cf64142c546d31687279f74eb0a9d11522621736c844c7955e4d16be8063d481552adb328dbaaff6eff60954a776b39f124d131b6dd4dc0c4fc53b96d42adb57cfeaef515d23348e72271c7c2147a6c28ea374adfea6cb572b47e5aa216dc69b15744db0a12abdec30f47745c4122e19af91b93e6ad2206292eb1ba491c0c279ea3fb8bf7407200ac9208d98c5784538105cbe6fe6b5498402785c710bb7370ef6918410745557cf9643f3d2cc3a97ceb931a4c86d1ca85",
        "exponent": "65537"
      }
    },
    "has_expired": false,
    "fqdn_list": [
      "badssl.com"
    ]
  },
  "certificate": "MIIDeTCCAmGgAwIBAgIJAKWma2OjWmKCMA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ8wDQYDVQQKDAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTAeFw0yNjA5MjIyMTAwMTZaFw0yODA5MjEyMTAwMTZaMGIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ8wDQYDVQQKDAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMIE7PiM7gTCs9hQ1XBYzJMY61yoaEmwIrX5lZ6xKyx2PmzAS2BMTOqytMAPgLaw+XLJhgL5XEFdEyt/ccRLvOmULlA3pmccYYz2QULFRtMWhyefdOsKnRFSJiFzbIRMeVXk0WvoBj1IFVKtsyjbqv9u/2CVSndrOfEk0TG23U3AxPxTuW1CrbV8/q71FdIzSOciccfCFHpsKOo3St/qbLVytH5aohbcabFXRNsKEqveww9HdFxBIuGa+RuT5q0iBikusbpJHAwnnqP7i/dAcgCskgjZjFeEU4EFy+b+a1SYQCeFxxC7c3DvaRhBB0VVfPlkPz0sw6l865MaTIbRyoUCAwEAAaMyMDAwCQYDVR0TBAIwADAjBgNVHREEHDAaggwqLmJhZHNzbC5jb22CCmJhZHNzbC5jb20wDQYJKoZIhvcNAQELBQADggEBAJYSq+AqV7tU53oXPYqICD2zH9Z5mKfIos/94gHDP8vBnIsCrhPKarlb8MOEND1SA8iecdw62D5kGPyIryHSF5YVjm1hiEh+7uVpRs7muhoXOcICoBnMsPHwfMRC+NIiuWNo+xo9D001B3sjTuBQfqbJz/Uwtq2f4myOIIyVIPoJ8SWyQAYUp0r+R6JkNpCSJwPeTOu9umwLxgRivHVFpdesr3YIrzhWlIqQDpREO5XqgsE/Gquh7aggCQ3SaupVWuw4+RmlGtoWKK73JC1rTier6la5WoS5WubJl0GtSlOkIG2h8FMjZHZQYUPDWrrT76q4D29HdPv0bVWlFJIk4/8=",
  "parse_errors": []
}
```

## Related Examples

- [An Expired Certificate](/reference/lookup/ssl/examples/expired/)
- [An Untrusted Root](/reference/lookup/ssl/examples/untrusted-root/)
- [A Certificate for Another Host Name](/reference/lookup/ssl/examples/wrong-host/)
- [An Elliptic Curve (ECDSA) Key](/reference/lookup/ssl/examples/ecdsa-key/)
- [Mail Server on Port 465](/reference/lookup/ssl/examples/port-465/)
- [A Host Name That Does Not Resolve](/reference/lookup/ssl/examples/not-resolved/)