# DNS Intelligence API – SSL Certificate Lookup

> DNS Intelligence API – SSL Certificate Lookup is a paid API for AI agents from dns.payapi.market, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-17).

Fetches live TLS/SSL certificate details for a domain, including issuer, validity dates, SANs, cipher suite, and days remaining.

## Facts

- Endpoint: POST https://dns.payapi.market/dns/ssl?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-intelligence-api-ssl-certificate-lookup-86820e7a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_UqE0U_T9lWafeOGBl1x-c

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-intelligence-api-ssl-certificate-lookup-86820e7a -d '<json body>'
```

Example prompt: Can you pull the live SSL certificate details for example.com on port 443 — I want to see the issuer, expiry date, TLS version, and which domains the cert covers?

## When to prefer this

Use this endpoint when you need to inspect a live, real-time TLS certificate from a domain's server rather than looking up cached or historical cert data. It is ideal for certificate expiry monitoring, security audits of cipher suites and TLS versions, verifying SAN coverage, and checking issuer chains — especially when you need current data straight from the TLS handshake rather than a certificate transparency log.

## Known failure modes

- Domain does not exist or is unreachable — connection timeout or DNS resolution failure
- Port is not running a TLS service — handshake failure
- Self-signed or expired certificate may still be returned but flagged in context
- Invalid domain format returns a validation error
- Non-standard ports blocked by firewall return connection refused

## How this service works

DNS records, WHOIS, SSL certificate, subdomain discovery, and reverse-IP lookup with x402 payments.

## Output

Returns a JSON object with full SSL/TLS certificate details including: issuer (common name, organization, country), subject common name, subject alternative names (SANs), TLS version (e.g. TLSv1.3), cipher suite, certificate serial number, validity window (not_before, not_after), days remaining until expiry, and the port used for the handshake.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "port": {
   "type": "integer",
   "maximum": 65535,
   "minimum": 1,
   "description": "TLS port for the handshake. Defaults to 443."
  },
  "domain": {
   "type": "string",
   "description": "Domain name to fetch the live TLS certificate from, e.g. 'example.com'."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "port": 443,
  "domain": "example.com",
  "issuer": {
   "commonName": "DigiCert Global G3 TLS ECC SHA384 2020 CA1",
   "countryName": "US",
   "organizationName": "DigiCert Inc"
  },
  "subject": {
   "commonName": "*.example.com"
  },
  "version": 3,
  "not_after": "2026-01-15T23:59:59",
  "san_count": 2,
  "not_before": "2025-01-15T00:00:00",
  "tls_version": "TLSv1.3",
  "cipher_suite": "TLS_AES_256_GCM_SHA384",
  "serial_number": "0A1B2C3D4E5F60718293A4B5C6D7E8F9",
  "days_remaining": 163,
  "subject_alt_names": [
   "*.example.com",
   "example.com"
  ],
  "issuer_common_name": "DigiCert Global G3 TLS ECC SHA384 2020 CA1",
  "issuer_organization": "DigiCert Inc",
  "subject_common_name": "*.example.com"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-intelligence-api-ssl-certificate-lookup-86820e7a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.payapi.market](https://www.zero.xyz/host/dns.payapi.market/llms.txt)