# An Untrusted Root

A certificate from an untrusted root CA: valid is false with "self-signed certificate in certificate chain".

Source: https://docs.deepinfo.com/reference/lookup/ssl/examples/untrusted-root/

Last updated: 2026-09-24

---
`GET https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com`

A certificate from an untrusted root CA: valid is false with "self-signed certificate in certificate chain".

Example 3 of 4 in **Certificate Problems** · [SSL Certificate Examples](/reference/lookup/ssl/examples/) · endpoint: [SSL](/reference/lookup/ssl/)

Tags: `param` `target` · `value` `untrusted-root.badssl.com`

Asks for the certificate of `untrusted-root.badssl.com`.

The certificate is issued by `BadSSL Untrusted Root Certificate Authority`, a CA no browser trusts. It is not self-signed itself (`self_signed` is `false`), but `signature.valid` is `false` with `invalid_reason` `self-signed certificate in certificate chain`: the chain ends in a root that is not trusted.

## Request

| Parameter | In | Value |
|---|---|---|
| `target` | query | `untrusted-root.badssl.com` |

```bash
curl 'https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'
```

## Response

### 200 · OK

`Content-Type: application/json` · `ratelimit-limit: 100` · `ratelimit-remaining: 93` · `ratelimit-reset: 2` · `x-ratelimit-limit-minute: 100` · `x-ratelimit-remaining-minute: 93` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a`

```json
{
  "target": "untrusted-root.badssl.com",
  "port": 443,
  "check_date": "2026-09-24T07:51:59Z",
  "connection_status": "success",
  "parsed": {
    "version": {
      "name": "v3",
      "value": "2"
    },
    "fingerprint_sha1": "6a71040d04fb45a181d313db514f1a2a7aef02af",
    "fingerprint_sha256": "21b7eacae50abea404164e4c23d7fcd0552186f9b305eee2743be1079d80a834",
    "fingerprint_md5": "084ee7cc309c1382e5343048bd369f55",
    "subject": {
      "dn": "CN=*.badssl.com,O=BadSSL,L=San Francisco,ST=California,C=US",
      "common_name": "*.badssl.com",
      "country_name": "US",
      "locality": "San Francisco",
      "organization": "BadSSL",
      "organizational_unit": null,
      "state": "California"
    },
    "signature": {
      "value": "lMtNHm/lrZcwASsotjczch5WeGUQvaboZFg+QNDn7dO1XnA3yvfLxVKSw28suv0gdqy4ffQ9mhl+GYjK0bx7Hs+u49FxIOSDiJSAJc3XYduPWVpgC1qlIp6/bGA1nAuanaWgJd7cBGgVbO3J+Fg04/o02W8mHGzqsC1G9tUIVQPy2LrUEIvufehp7T/5fHY4hlB9+KaDQZyo09USRS03uKeFc3FrYIApqi9VEkpnMK3PM3/OcUzc84IddSLrIg+IWmwNc0wnG0hJAvyqqTba0E73qXdemIJ9gtAZ6zmqwNnshh7vc5XrU8+aWIT0719NPEBFbwiX5ai3vwOQKCgphSD36MrCWjbyx4XULbJd/r3fkUK7+jRmdNhpaDk8H4YrMB564V84dtXdPoCJfGDCTudbGTufFvbULaHCJdKHr7M1XJ6X2ejnNqw00aUurpv7FAgpsJxLwrqRTnjGzX9F1P+Cw5NiBg6IgFM9fGxe/FXIw2uwEpX+r3jnCTJ9stDtj0W6G9gQ92qX7Jsvgtump0vyqimkdkLo4VHTwHXJgXqU+m10Y752owZibKYRQYLvVFdT+lkNqYg/g6cTd1DLWAMfHEki/hCvmU/Gk4C9Ia3PjcKGS0IixgHKOC5P8CTlXDVHlvEOZsdQL8Y1JnbSjGdjCXZbSsj+FabOxrH8Fj4=",
      "self_signed": false,
      "valid": false,
      "valid_chain": true,
      "invalid_reason": "self-signed certificate in certificate chain",
      "signature_algorithm": {
        "oid": "1.2.840.113549.1.1.11",
        "name": "sha256"
      }
    },
    "validity": {
      "start": "2026-09-22T21:00:16Z",
      "length": 63072000,
      "end": "2028-09-21T21:00:16Z"
    },
    "issuer": {
      "dn": "CN=BadSSL Untrusted Root Certificate Authority,O=BadSSL,L=San Francisco,ST=California,C=US",
      "common_name": "BadSSL Untrusted Root Certificate Authority",
      "country_name": "US",
      "locality": "San Francisco",
      "organization": "BadSSL",
      "organizational_unit": null,
      "state": "California"
    },
    "extensions": {
      "key_usage": null,
      "extended_key_usage": null,
      "basic_constraints": {
        "is_ca": false
      },
      "subject_key_identifier": null,
      "authority_key_identifier": null,
      "authority_info_access": null,
      "subject_alt_name": {
        "dns_names": [
          "*.badssl.com",
          "badssl.com"
        ]
      },
      "certificate_policies": [],
      "crl_distribution_points": [],
      "signed_certificate_timestamp": [],
      "other_extensions": []
    },
    "serial_number": "12152802120148391526",
    "tbs_fingerprint": "25a5ac389cf5153a368f74fad95bf05a33fd292a288e9f2342330865c7771b61",
    "subject_key_info": {
      "fingerprint": {
        "hash_algorithm_name": "sha256",
        "value": "21b7eacae50abea404164e4c23d7fcd0552186f9b305eee2743be1079d80a834"
      },
      "key_algorithm": {
        "name": "RSA"
      },
      "rsa_public_key": {
        "length": "2048",
        "modulus": "c204ecf88cee04c2b3d850d57058cc9318eb5ca86849b022b5f9959eb12b2c763e6cc04b604c4ceab2b4c00f80b6b0f972c98602f95c415d132b7f71c44bbce9942e5037a6671c618cf64142c546d31687279f74eb0a9d11522621736c844c7955e4d16be8063d481552adb328dbaaff6eff60954a776b39f124d131b6dd4dc0c4fc53b96d42adb57cfeaef515d23348e72271c7c2147a6c28ea374adfea6cb572b47e5aa216dc69b15744db0a12abdec30f47745c4122e19af91b93e6ad2206292eb1ba491c0c279ea3fb8bf7407200ac9208d98c5784538105cbe6fe6b5498402785c710bb7370ef6918410745557cf9643f3d2cc3a97ceb931a4c86d1ca85",
        "exponent": "65537"
      }
    },
    "has_expired": false,
    "fqdn_list": [
      "badssl.com"
    ]
  },
  "certificate": "MIIEmTCCAoGgAwIBAgIJAKinbSPVDxZmMA0GCSqGSIb3DQEBCwUAMIGBMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEPMA0GA1UECgwGQmFkU1NMMTQwMgYDVQQDDCtCYWRTU0wgVW50cnVzdGVkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTI2MDkyMjIxMDAxNloXDTI4MDkyMTIxMDAxNlowYjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoMBkJhZFNTTDEVMBMGA1UEAwwMKi5iYWRzc2wuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwgTs+IzuBMKz2FDVcFjMkxjrXKhoSbAitfmVnrErLHY+bMBLYExM6rK0wA+AtrD5csmGAvlcQV0TK39xxEu86ZQuUDemZxxhjPZBQsVG0xaHJ5906wqdEVImIXNshEx5VeTRa+gGPUgVUq2zKNuq/27/YJVKd2s58STRMbbdTcDE/FO5bUKttXz+rvUV0jNI5yJxx8IUemwo6jdK3+pstXK0flqiFtxpsVdE2woSq97DD0d0XEEi4Zr5G5PmrSIGKS6xukkcDCeeo/uL90ByAKySCNmMV4RTgQXL5v5rVJhAJ4XHELtzcO9pGEEHRVV8+WQ/PSzDqXzrkxpMhtHKhQIDAQABozIwMDAJBgNVHRMEAjAAMCMGA1UdEQQcMBqCDCouYmFkc3NsLmNvbYIKYmFkc3NsLmNvbTANBgkqhkiG9w0BAQsFAAOCAgEAlMtNHm/lrZcwASsotjczch5WeGUQvaboZFg+QNDn7dO1XnA3yvfLxVKSw28suv0gdqy4ffQ9mhl+GYjK0bx7Hs+u49FxIOSDiJSAJc3XYduPWVpgC1qlIp6/bGA1nAuanaWgJd7cBGgVbO3J+Fg04/o02W8mHGzqsC1G9tUIVQPy2LrUEIvufehp7T/5fHY4hlB9+KaDQZyo09USRS03uKeFc3FrYIApqi9VEkpnMK3PM3/OcUzc84IddSLrIg+IWmwNc0wnG0hJAvyqqTba0E73qXdemIJ9gtAZ6zmqwNnshh7vc5XrU8+aWIT0719NPEBFbwiX5ai3vwOQKCgphSD36MrCWjbyx4XULbJd/r3fkUK7+jRmdNhpaDk8H4YrMB564V84dtXdPoCJfGDCTudbGTufFvbULaHCJdKHr7M1XJ6X2ejnNqw00aUurpv7FAgpsJxLwrqRTnjGzX9F1P+Cw5NiBg6IgFM9fGxe/FXIw2uwEpX+r3jnCTJ9stDtj0W6G9gQ92qX7Jsvgtump0vyqimkdkLo4VHTwHXJgXqU+m10Y752owZibKYRQYLvVFdT+lkNqYg/g6cTd1DLWAMfHEki/hCvmU/Gk4C9Ia3PjcKGS0IixgHKOC5P8CTlXDVHlvEOZsdQL8Y1JnbSjGdjCXZbSsj+FabOxrH8Fj4=",
  "parse_errors": []
}
```

## Related Examples

- [A Self-Signed Certificate](/reference/lookup/ssl/examples/self-signed/)
- [A Certificate for Another Host Name](/reference/lookup/ssl/examples/wrong-host/)
- [An Expired Certificate](/reference/lookup/ssl/examples/expired/)
- [A Host Name That Does Not Resolve](/reference/lookup/ssl/examples/not-resolved/)
- [An Elliptic Curve (ECDSA) Key](/reference/lookup/ssl/examples/ecdsa-key/)
- [A Port Without TLS](/reference/lookup/ssl/examples/no-tls-on-port/)