# fetchx402 SSL Certificate Inspector

> fetchx402 SSL Certificate Inspector is a paid API for AI agents from api.fetchx402.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Fetches and inspects the live TLS/SSL certificate for a public hostname, returning validity, issuer, SANs, fingerprint, and expiry status as structured JSON.

## Facts

- Endpoint: GET https://api.fetchx402.com/v1/tools/ssl-check
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fetchx402-ssl-certificate-inspector-5e8db1d2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VX_PigJf6kjWxOCxpyAdT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fetchx402-ssl-certificate-inspector-5e8db1d2
```

Example prompt: Can you check the SSL certificate for api.example.com and tell me whether it's valid, when it expires, who issued it, and what domains it covers?

## When to prefer this

Use this endpoint when you need live, authoritative TLS certificate facts for a public domain and cannot rely on cached or guessed data. It is especially useful for security audits, pre-deployment checks, and monitoring expiry — and uniquely returns structured JSON flags even for expired or hostname-mismatched certificates, making it safe for automated pass/fail logic.

## Known failure modes

- Domain is an IP address, localhost, or internal/mDNS name — rejected with an error
- Domain does not exist or DNS resolution fails
- No TLS listener on port 443 — connection refused or timeout
- Certificate chain cannot be retrieved — partial or empty result
- Invalid domain format in query parameter — validation error

## How this service works

Inspect the leaf TLS certificate for a public hostname (validity, issuer, SANs, fingerprint, expiry). Use when you need live cert facts and must not guess. Expired or hostname-mismatched certs still return JSON flags.

## Output

A JSON object containing the certificate's validity status (boolean), expiry date and days remaining, issuer details (organization, common name), Subject Alternative Names (SANs) covered by the cert, SHA fingerprint, and boolean flags for hostname mismatch and expiration — even if the cert is expired or mismatched.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "headers": {
     "type": "object",
     "additionalProperties": {
      "type": "string"
     }
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "port": {
       "enum": [
        443
       ],
       "type": "integer",
       "description": "TLS port. v1 accepts 443 only. Defaults to 443 if omitted."
      },
      "domain": {
       "type": "string",
       "description": "Public fully-qualified domain name to inspect, such as example.com. IPs, localhost, and internal/mDNS names are rejected."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "sni": "example.com",
  "port": 443,
  "sans": [
   "www.example.org",
   "example.com",
   "example.net",
   "example.org"
  ],
  "cipher": "aes_256_gcm_sha384",
  "domain": "example.com",
  "issuer": "CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1, O=DigiCert Inc, C=US",
  "serial": "0f1a2b3c4d5e6f708192a3b4c5d6e7f8",
  "expired": false,
  "peer_ip": "23.215.0.138",
  "subject": "CN=www.example.org, O=Internet Corporation for Assigned Names and Numbers, C=US",
  "not_after": "2027-01-15T23:59:59Z",
  "not_before": "2026-01-15T00:00:00Z",
  "tls_version": "tlsv1.3",
  "not_yet_valid": false,
  "hostname_match": true,
  "fingerprint_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "signature_algorithm": "ecdsa-with-SHA384"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fetchx402-ssl-certificate-inspector-5e8db1d2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.fetchx402.com](https://www.zero.xyz/host/api.fetchx402.com/llms.txt)