SSL/TLS Checker API

This API runs a full SSL/TLS scan for a host and returns a JSON report: certificate chain, protocol and cipher support, known vulnerabilities, ALPN, the HTTP redirect chain, HSTS, CAA, revocation status, and a letter grade. No API key, no signup.

Every check is a full scan (no quick/extended toggle) and results are cached for 24 hours, keyed by host, port, and protocol.

European by default. Scanning servers in Germany and Finland, reports stored in an EU database. How the data is handled.

Quick start

curl "https://api.ssltest.com/v1/check?host=example.com"

A cold check has nothing cached yet, so the first call returns 202 with a poll URL. Poll it (or use the SSE stream below) until the report is ready:

{
  "status": "processing",
  "report_id": "a1b2c3d4e5f60718293a",
  "poll": "/v1/check?host=example.com"
}

Endpoints

Target format

host accepts a bare host (example.com), a host with an explicit port (example.com:8443), or protocol/host[:port] for a non-HTTPS check (smtp/mail.example.com, imap/mail.example.com:993). A protocol and port can also be passed as separate proto=/port= query params instead of the combined form.

Direct-TLS protocols: https, ftps, smtps, pop3s, imaps, ldaps. STARTTLS protocols: smtp, smtp-submission, imap, pop3, ftp, ldap, xmpp, nntp. Each has a default port used when none is given.

Response

Returned once the report is ready (fields trimmed for brevity):

{
  "host": "example.com",
  "port": 443,
  "protocol": "https",
  "scanned_at": 1753272000,
  "cached": true,
  "primary_ip": "93.184.216.34",
  "consistent": true,
  "days_until_expiry": 207,
  "primary_result": {
    "hostname": "example.com",
    "port": 443,
    "success": true,
    "chain_valid": true,
    "hostname_match": true,
    "connection": {
      "protocol": "TLSv1.3",
      "cipher": "TLS_AES_128_GCM_SHA256"
    },
    "grade": {
      "grade": "A",
      "cap": null,
      "cap_reason": null,
      "trust_only": false
    },
    "alpn": {
      "checked": true,
      "supported": true,
      "protocols": [
        "h2"
      ]
    },
    "http": {
      "checked": true,
      "status_code": 200,
      "downgrades_to_http": false
    },
    "alt_chains": {
      "checked": true,
      "chains": [],
      "problem": false
    },
    "certificates": [
      {
        "subject": {
          "common_name": "example.com"
        },
        "public_key": {
          "algorithm": "id-ecPublicKey",
          "size": 256
        },
        "key_strength": 3072,
        "validation_type": "DV",
        "pin_sha256": "Cq2gW1DVwWX5gG0Rf1Fq3zVe8i4mQe5xO6Yb0Y8pQfE="
      }
    ]
  },
  "ips": {
    "93-184-216-34": {
      "ip": "93.184.216.34",
      "grade": {
        "grade": "A"
      }
    }
  }
}

Status codes

A failure is reported for several minutes before another scan of the same target is attempted, so a poll loop against an unreachable host settles instead of queueing work.

Response headers

Rate limits

No key is needed, so limits are per client address. Polling a scan already running and reading a cached report are free: only starting a scan counts.

Scan duration

Measured over a 50-host sample: half the scans finished within a minute of the first request, and the slowest took six. A host resolving to many addresses is the slow case, because every address gets its own full handshake and its own vulnerability probes. The 202 response carries queue_position and an indicative eta_seconds for choosing a polling interval.

Cross-origin requests

Every endpoint here answers with Access-Control-Allow-Origin: *, so a browser script reaches the JSON, the stream and the spec directly. The Retry-After and X-RateLimit-* headers are listed in Access-Control-Expose-Headers, which is what lets a script read them.

Streaming events

GET /v1/check/stream?host=... enqueues a scan the same way /v1/check does, then streams named Server-Sent Events until the report is ready:

curl -N "https://api.ssltest.com/v1/check/stream?host=example.com"

MCP

The same check is also exposed as an MCP tool (ssl_check) over Streamable HTTP at api.ssltest.com/mcp. See mcp.ssltest.com for connection instructions.

Limitations

One scan runs per host, port and protocol at a time, and a report is cached for 24 hours. Scans reach public addresses only: private, loopback and otherwise non-routable targets are refused. A host whose owner published the opt-out record is never scanned.

Frequently asked

Terms and policies

Use of the API is subject to the Terms of Service and Privacy Policy. To report abuse, or to stop a host being scanned, see Opt-out.