SSL Certificate Examples · Example 3 of 4 in Certificate Problems

An Untrusted Root

GEThttps://api.deepinfo.com/v1/lookup/ssl

A certificate from an untrusted root CA: valid is false with "self-signed certificate in certificate chain".

Param: target
Value: untrusted-root.badssl.com

Asks for the certificate of untrusted-root.badssl.com.

The certificate is issued by BadSSL Untrusted Root Certificate Authority, a CA no browser trusts. It is not self-signed itself (self_signed is false), but signature.valid is false with invalid_reason self-signed certificate in certificate chain: the chain ends in a root that is not trusted.

Request

curl

curl 'https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/lookup/ssl"

params = {
    "target": "untrusted-root.badssl.com"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, params=params, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/lookup/ssl?target=untrusted-root.badssl.com')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Response Body

{
  "target": "untrusted-root.badssl.com",
  "port": 443,
  "check_date": "2026-09-24T07:51:59Z",
  "connection_status": "success",
  "parsed": {
    "version": {
      "name": "v3",
      "value": "2"
    },
    "fingerprint_sha1": "6a71040d04fb45a181d313db514f1a2a7aef02af",
    "fingerprint_sha256": "21b7eacae50abea404164e4c23d7fcd0552186f9b305eee2743be1079d80a834",
    "fingerprint_md5": "084ee7cc309c1382e5343048bd369f55",
    "subject": {
      "dn": "CN=*.badssl.com,O=BadSSL,L=San Francisco,ST=California,C=US",
      "common_name": "*.badssl.com",
      "country_name": "US",
      "locality": "San Francisco",
      "organization": "BadSSL",
      "organizational_unit": null,
      "state": "California"
    },
    "signature": {
      "value": "lMtNHm/lrZcwASsotjczch5WeGUQvaboZFg+QNDn7dO1XnA3yvfLxVKSw28suv0gdqy4ffQ9mhl+GYjK0bx7Hs+u49FxIOSDiJSAJc3XYduPWVpgC1qlIp6/bGA1nAuanaWgJd7cBGgVbO3J+Fg04/o02W8mHGzqsC1G9tUIVQPy2LrUEIvufehp7T/5fHY4hlB9+KaDQZyo09USRS03uKeFc3FrYIApqi9VEkpnMK3PM3/OcUzc84IddSLrIg+IWmwNc0wnG0hJAvyqqTba0E73qXdemIJ9gtAZ6zmqwNnshh7vc5XrU8+aWIT0719NPEBFbwiX5ai3vwOQKCgphSD36MrCWjbyx4XULbJd/r3fkUK7+jRmdNhpaDk8H4YrMB564V84dtXdPoCJfGDCTudbGTufFvbULaHCJdKHr7M1XJ6X2ejnNqw00aUurpv7FAgpsJxLwrqRTnjGzX9F1P+Cw5NiBg6IgFM9fGxe/FXIw2uwEpX+r3jnCTJ9stDtj0W6G9gQ92qX7Jsvgtump0vyqimkdkLo4VHTwHXJgXqU+m10Y752owZibKYRQYLvVFdT+lkNqYg/g6cTd1DLWAMfHEki/hCvmU/Gk4C9Ia3PjcKGS0IixgHKOC5P8CTlXDVHlvEOZsdQL8Y1JnbSjGdjCXZbSsj+FabOxrH8Fj4=",
      "self_signed": false,
      "valid": false,
      "valid_chain": true,
      "invalid_reason": "self-signed certificate in certificate chain",
      "signature_algorithm": {
        "oid": "1.2.840.113549.1.1.11",
        "name": "sha256"
      }
    },
    "validity": {
      "start": "2026-09-22T21:00:16Z",
      "length": 63072000,
      "end": "2028-09-21T21:00:16Z"
    },
    "issuer": {
      "dn": "CN=BadSSL Untrusted Root Certificate Authority,O=BadSSL,L=San Francisco,ST=California,C=US",
      "common_name": "BadSSL Untrusted Root Certificate Authority",
      "country_name": "US",
      "locality": "San Francisco",
      "organization": "BadSSL",
      "organizational_unit": null,
      "state": "California"
    },
    "extensions": {
      "key_usage": null,
      "extended_key_usage": null,
      "basic_constraints": {
        "is_ca": false
      },
      "subject_key_identifier": null,
      "authority_key_identifier": null,
      "authority_info_access": null,
      "subject_alt_name": {
        "dns_names": [
          "*.badssl.com",
          "badssl.com"
        ]
      },
      "certificate_policies": [],
      "crl_distribution_points": [],
      "signed_certificate_timestamp": [],
      "other_extensions": []
    },
    "serial_number": "12152802120148391526",
    "tbs_fingerprint": "25a5ac389cf5153a368f74fad95bf05a33fd292a288e9f2342330865c7771b61",
    "subject_key_info": {
      "fingerprint": {
        "hash_algorithm_name": "sha256",
        "value": "21b7eacae50abea404164e4c23d7fcd0552186f9b305eee2743be1079d80a834"
      },
      "key_algorithm": {
        "name": "RSA"
      },
      "rsa_public_key": {
        "length": "2048",
        "modulus": "c204ecf88cee04c2b3d850d57058cc9318eb5ca86849b022b5f9959eb12b2c763e6cc04b604c4ceab2b4c00f80b6b0f972c98602f95c415d132b7f71c44bbce9942e5037a6671c618cf64142c546d31687279f74eb0a9d11522621736c844c7955e4d16be8063d481552adb328dbaaff6eff60954a776b39f124d131b6dd4dc0c4fc53b96d42adb57cfeaef515d23348e72271c7c2147a6c28ea374adfea6cb572b47e5aa216dc69b15744db0a12abdec30f47745c4122e19af91b93e6ad2206292eb1ba491c0c279ea3fb8bf7407200ac9208d98c5784538105cbe6fe6b5498402785c710bb7370ef6918410745557cf9643f3d2cc3a97ceb931a4c86d1ca85",
        "exponent": "65537"
      }
    },
    "has_expired": false,
    "fqdn_list": [
      "badssl.com"
    ]
  },
  "certificate": "MIIEmTCCAoGgAwIBAgIJAKinbSPVDxZmMA0GCSqGSIb3DQEBCwUAMIGBMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEPMA0GA1UECgwGQmFkU1NMMTQwMgYDVQQDDCtCYWRTU0wgVW50cnVzdGVkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTI2MDkyMjIxMDAxNloXDTI4MDkyMTIxMDAxNlowYjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoMBkJhZFNTTDEVMBMGA1UEAwwMKi5iYWRzc2wuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwgTs+IzuBMKz2FDVcFjMkxjrXKhoSbAitfmVnrErLHY+bMBLYExM6rK0wA+AtrD5csmGAvlcQV0TK39xxEu86ZQuUDemZxxhjPZBQsVG0xaHJ5906wqdEVImIXNshEx5VeTRa+gGPUgVUq2zKNuq/27/YJVKd2s58STRMbbdTcDE/FO5bUKttXz+rvUV0jNI5yJxx8IUemwo6jdK3+pstXK0flqiFtxpsVdE2woSq97DD0d0XEEi4Zr5G5PmrSIGKS6xukkcDCeeo/uL90ByAKySCNmMV4RTgQXL5v5rVJhAJ4XHELtzcO9pGEEHRVV8+WQ/PSzDqXzrkxpMhtHKhQIDAQABozIwMDAJBgNVHRMEAjAAMCMGA1UdEQQcMBqCDCouYmFkc3NsLmNvbYIKYmFkc3NsLmNvbTANBgkqhkiG9w0BAQsFAAOCAgEAlMtNHm/lrZcwASsotjczch5WeGUQvaboZFg+QNDn7dO1XnA3yvfLxVKSw28suv0gdqy4ffQ9mhl+GYjK0bx7Hs+u49FxIOSDiJSAJc3XYduPWVpgC1qlIp6/bGA1nAuanaWgJd7cBGgVbO3J+Fg04/o02W8mHGzqsC1G9tUIVQPy2LrUEIvufehp7T/5fHY4hlB9+KaDQZyo09USRS03uKeFc3FrYIApqi9VEkpnMK3PM3/OcUzc84IddSLrIg+IWmwNc0wnG0hJAvyqqTba0E73qXdemIJ9gtAZ6zmqwNnshh7vc5XrU8+aWIT0719NPEBFbwiX5ai3vwOQKCgphSD36MrCWjbyx4XULbJd/r3fkUK7+jRmdNhpaDk8H4YrMB564V84dtXdPoCJfGDCTudbGTufFvbULaHCJdKHr7M1XJ6X2ejnNqw00aUurpv7FAgpsJxLwrqRTnjGzX9F1P+Cw5NiBg6IgFM9fGxe/FXIw2uwEpX+r3jnCTJ9stDtj0W6G9gQ92qX7Jsvgtump0vyqimkdkLo4VHTwHXJgXqU+m10Y752owZibKYRQYLvVFdT+lkNqYg/g6cTd1DLWAMfHEki/hCvmU/Gk4C9Ia3PjcKGS0IixgHKOC5P8CTlXDVHlvEOZsdQL8Y1JnbSjGdjCXZbSsj+FabOxrH8Fj4=",
  "parse_errors": []
}

Content-Type: application/json
ratelimit-limit: 100
ratelimit-remaining: 93
ratelimit-reset: 2
x-ratelimit-limit-minute: 100
x-ratelimit-remaining-minute: 93
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on SSL; the exact request is in the code panel.

Parameter	Value
`target`query	`untrusted-root.badssl.com`

Reference updated September 24, 2026

Request

Related Examples