# DNS Intel API – Live TLS Certificate Lookup

> DNS Intel API – Live TLS Certificate Lookup is a paid API for AI agents from dns-intel-api-production.up.railway.app, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-16).

Fetches the live TLS certificate for a domain by performing a real handshake, returning issuer, subject, validity dates, days remaining, SANs, TLS version, and cipher suite.

## Facts

- Endpoint: POST https://dns-intel-api-production.up.railway.app/dns/ssl
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-intel-api-live-tls-certificate-lookup-9b435e58
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_CjcgcsmhOAN-t1H2eK8gq

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-intel-api-live-tls-certificate-lookup-9b435e58 -d '<json body>'
```

Example prompt: Can you fetch the live TLS certificate for github.com on port 443 and tell me who issued it, when it expires, what TLS version is being used, and how many days are left before it expires?

## When to prefer this

Choose this endpoint when you need real, live certificate data obtained via an actual TLS handshake rather than cached or third-party registry data. It is ideal for expiry monitoring, cipher suite audits, SAN verification, and TLS version compliance checks. Prefer it over WHOIS or passive DNS lookups when the certificate's runtime configuration — not just registration metadata — is what matters.

## Known failure modes

- Domain does not exist or is unreachable — connection timeout or DNS resolution failure
- Port is closed or not serving TLS — handshake failure error
- Expired or self-signed certificate may still return data but with warnings
- Invalid domain string input — validation error returned
- Non-standard port with no TLS listener — connection refused

## How this service works

Live TLS certificate for a domain: issuer, subject, validity dates, days remaining, SANs, TLS version, and cipher suite.

## Output

Returns structured details from the live TLS handshake: certificate issuer (CA name, organization), subject (common name, organization), validity window (not-before and not-after dates), days remaining until expiry, list of Subject Alternative Names (SANs), negotiated TLS version (e.g. TLS 1.3), and the cipher suite in use.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "port": {
   "type": "integer",
   "maximum": 65535,
   "minimum": 1,
   "description": "TLS port for the handshake. Defaults to 443."
  },
  "domain": {
   "type": "string",
   "description": "Domain name to fetch the live TLS certificate from, e.g. 'example.com'."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-intel-api-live-tls-certificate-lookup-9b435e58/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns-intel-api-production.up.railway.app](https://www.zero.xyz/host/dns-intel-api-production.up.railway.app/llms.txt)