# 2s.io TLS Certificate Inspector

> 2s.io TLS Certificate Inspector is a paid API for AI agents from 2s.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15).

Opens a live TLS connection to any public host and returns full certificate details including expiry, chain validation, SANs, fingerprint, and negotiated protocol/cipher.

## Facts

- Endpoint: GET https://2s.io/api/tls/cert-info
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-io-tls-certificate-inspector-0425e104
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_GOlFZD4rp0OH3JcIYTCky

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-io-tls-certificate-inspector-0425e104
```

Example prompt: Check the TLS certificate for api.stripe.com — I want to know who issued it, when it expires, whether the chain is valid, and the SHA-256 fingerprint.

## When to prefer this

Use this endpoint when you need a real-time, live network probe of a TLS endpoint from outside an AI sandbox — especially for certificate expiry monitoring, TLS audit workflows, verifying certificate issuers, or checking SANs on a domain you don't control. Prefer this over static certificate databases when freshness and actual negotiation details (cipher, protocol) matter.

## Known failure modes

- Host resolves to a private/reserved IP address — SSRF guard blocks the request
- Host does not exist or DNS resolution fails — returns error with resolution failure detail
- Connection refused or timeout on specified port — returns network error
- Port out of range 1-65535 — input validation error

## How this service works

Open a live TLS connection to a host and return its certificate. Give a host (and optional port, default 443). Returns the negotiated TLS protocol + cipher, whether the chain validates against system roots, and the leaf certificate's subject + issuer (CN/O/C), validity window (valid-from / valid-to), days until expiry + expired flag, serial number, SHA-256 fingerprint, Subject Alternative Names, and the chain length. A genuine network probe agents can't do from their sandbox — for cert-expiry monitoring, TLS audits, and verifying who issued a site's certificate. SSRF-guarded: the host must resolve to a public address. Self-signed and expired certs are reported (not rejected).

## Output

Returns the negotiated TLS protocol and cipher, chain validation status against system roots, leaf certificate subject and issuer (CN/O/C), validity window (valid-from and valid-to), days until expiry with an expired flag, serial number, SHA-256 fingerprint, Subject Alternative Names list, and chain length.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "host": "google.com",
   "port": 443
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "host"
     ],
     "properties": {
      "host": {
       "type": "string",
       "description": "Hostname or IP to probe."
      },
      "port": {
       "type": "integer",
       "default": 443,
       "maximum": 65535,
       "minimum": 1
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-io-tls-certificate-inspector-0425e104/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)