SSL Certificate Check

Check a domain's SSL/TLS certificate: issuer, validity dates, days to expiry, protocol, cipher and the names it covers.

Pay by wallet (x402) ssl-check

Example

Example answer

{
  "valid": true,
  "domain": "google.com",
  "issuer": "Google Trust Services",
  "subject": "*.google.com",
  "protocol": "TLSv1.3",
  "valid_to": "2026-04-27T08:36:37.000Z",
  "is_expired": false,
  "valid_from": "2026-02-02T08:36:38.000Z",
  "cipher_name": "TLS_AES_256_GCM_SHA384",
  "serial_number": "B24FF93A9975FA670A45A4784F3ACC65",
  "cipher_version": "TLSv1.3",
  "is_expiring_soon": false,
  "days_until_expiry": 51,
  "subject_alt_names": [
    "*.google.com",
    "*.appengine.google.com",
    "*.bdn.dev",
    "*.origin-test.bdn.dev",
    "*.cloud.google.com",
    "*.crowdsource.google.com",
    "*.datacompute.google.com",
    "*.google.ca",
    "*.google.cl",
    "*.google.co.in",
    "*.google.co.jp",
    "*.google.co.uk",
    "*.google.com.ar",
    "*.google.com.au",
    "*.google.com.br",
    "*.google.com.co",
    "*.google.com.mx",
    "*.google.com.tr",
    "*.google.com.vn",
    "*.google.de",
    "*.google.es",
    "*.google.fr",
    "*.google.hu",
    "*.google.it",
    "*.google.nl",
    "*.google.pl",
    "*.google.pt",
    "*.googleapis.cn",
    "*.gstatic.cn",
    "*.gstatic-cn.com",
    "googlecnapps.cn",
    "*.googlecnapps.cn",
    "googleapps-cn.com",
    "*.googleapps-cn.com",
    "gkecnapps.cn",
    "*.gkecnapps.cn",
    "googledownloads.cn",
    "*.googledownloads.cn",
    "recaptcha.net.cn",
    "*.recaptcha.net.cn",
    "recaptcha-cn.net",
    "*.recaptcha-cn.net",
    "widevine.cn",
    "*.widevine.cn",
    "ampproject.org.cn",
    "*.ampproject.org.cn",
    "ampproject.net.cn",
    "*.ampproject.net.cn",
    "google-analytics-cn.com",
    "*.google-analytics-cn.com",
    "googleadservices-cn.com",
    "*.googleadservices-cn.com",
    "googlevads-cn.com",
    "*.googlevads-cn.com",
    "googleapis-cn.com",
    "*.googleapis-cn.com",
    "googleoptimize-cn.com",
    "*.googleoptimize-cn.com",
    "doubleclick-cn.net",
    "*.doubleclick-cn.net",
    "*.fls.doubleclick-cn.net",
    "*.g.doubleclick-cn.net",
    "doubleclick.cn",
    "*.doubleclick.cn",
    "*.fls.doubleclick.cn",
    "*.g.doubleclick.cn",
    "dartsearch-cn.net",
    "*.dartsearch-cn.net",
    "googletraveladservices-cn.com",
    "*.googletraveladservices-cn.com",
    "googletagservices-cn.com",
    "*.googletagservices-cn.com",
    "googletagmanager-cn.com",
    "*.googletagmanager-cn.com",
    "googlesyndication-cn.com",
    "*.googlesyndication-cn.com",
    "*.safeframe.googlesyndication-cn.com",
    "app-measurement-cn.com",
    "*.app-measurement-cn.com",
    "gvt1-cn.com",
    "*.gvt1-cn.com",
    "gvt2-cn.com",
    "*.gvt2-cn.com",
    "2mdn-cn.net",
    "*.2mdn-cn.net",
    "googleflights-cn.net",
    "*.googleflights-cn.net",
    "admob-cn.com",
    "*.admob-cn.com",
    "*.gemini.cloud.google.com",
    "googlesandbox-cn.com",
    "*.googlesandbox-cn.com",
    "*.safenup.googlesandbox-cn.com",
    "*.gstatic.com",
    "*.metric.gstatic.com",
    "*.gvt1.com",
    "*.gcpcdn.gvt1.com",
    "*.gvt2.com",
    "*.gcp.gvt2.com",
    "*.url.google.com",
    "*.youtube-nocookie.com",
    "*.ytimg.com",
    "ai.android",
    "android.com",
    "*.android.com",
    "*.flash.android.com",
    "g.cn",
    "*.g.cn",
    "g.co",
    "*.g.co",
    "goo.gl",
    "www.goo.gl",
    "google-analytics.com",
    "*.google-analytics.com",
    "google.com",
    "googlecommerce.com",
    "*.googlecommerce.com",
    "ggpht.cn",
    "*.ggpht.cn",
    "urchin.com",
    "*.urchin.com",
    "youtu.be",
    "youtube.com",
    "*.youtube.com",
    "music.youtube.com",
    "*.music.youtube.com",
    "youtubeeducation.com",
    "*.youtubeeducation.com",
    "youtubekids.com",
    "*.youtubekids.com",
    "yt.be",
    "*.yt.be",
    "android.clients.google.com",
    "*.android.google.cn",
    "*.chrome.google.cn",
    "*.developers.google.cn",
    "*.aistudio.google.com"
  ],
  "fingerprint_sha256": "B3:D4:27:15:99:07:11:68:02:2E:99:B1:A2:49:72:AA:3C:7A:B5:AA:E0:E1:F2:BF:0B:6D:81:F2:F6:81:3E:09"
}

Inputs

Field	Type	Required	What it is
`domain`	string	Yes	Domain name (e.g. example.com)

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`valid`	boolean	Always (present in every successful answer)
`domain`	string	Always (present in every successful answer)
`issuer`	string	Always (present in every successful answer)
`valid_to`	string	Always (present in every successful answer)
`is_expired`	boolean	Always (present in every successful answer)
`days_until_expiry`	integer	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "ssl-check",
    "inputs": {
      "domain": "strale.dev"
    },
    "max_price_cents": 3
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "ssl-check",
    "inputs": {
      "domain": "strale.dev"
    },
    "max_price_cents": 3
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "ssl-check",
  inputs: {
    "domain": "strale.dev"
  },
  max_price_cents: 3,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="ssl-check",
    inputs={
        "domain": "strale.dev",
    },
    max_price_cents=3,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/ssl-check?domain=strale.dev'

Limitations

Only port 443 is checked
Checks the certificate presented on port 443 only — does not verify non-standard TLS configurations
What to do instead: For services on non-standard ports, use ssl-certificate-chain with the specific hostname:port combination