# Lookproof TLS Certificate Checker

> Lookproof TLS Certificate Checker is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-31).

Checks the TLS certificate served on port 443 for a domain, returning chain trust, name match, expiry, issuer, key/signature algorithms, TLS version, and coded findings.

## Facts

- Endpoint: GET https://api.lookproof.dev/v1/tls/certificate?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-tls-certificate-checker-22efedc5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_taBfmprVHGBnM-OViATRG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-tls-certificate-checker-22efedc5
```

Example prompt: Check the TLS certificate on api.example.com — I want to know if it's trusted, whether it matches the domain name, when it expires, and if there are any issues like weak algorithms or chain problems.

## When to prefer this

Choose this endpoint when an agent needs to diagnose HTTPS/TLS failures, verify certificate validity and trust chain, check imminent expiry, or audit the cryptographic configuration of a domain's certificate. It is purpose-built for structured, coded TLS findings (expired, mismatched, weak, untrusted) that go beyond a raw certificate dump, making it ideal for automated monitoring pipelines or security audits where machine-readable results are needed. Prefer it over generic DNS or HTTP tools when the specific concern is the X.509 certificate and TLS handshake, not DNS records or HTTP response content.

## Known failure modes

- Domain does not exist or cannot be resolved — connection error returned
- Domain is reachable but not serving TLS on port 443 — connection refused or timeout
- Certificate is completely absent or handshake fails — raw TLS error surfaced
- Invalid domain string provided — validation error on the input
- Rate limiting or payment failure — HTTP 402 or 429 response

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

Returns whether the certificate chains to a trusted root, whether the Subject Alternative Names match the domain per RFC 9525, the expiry date, the full certificate chain, issuer details, public key algorithm, signature algorithm, negotiated TLS version, and structured coded findings (e.g. expired, expiring-soon, untrusted, name-mismatch, weak-algorithm).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "title": "DomainInput",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "title": "Domain",
       "examples": [
        "example.com"
       ],
       "maxLength": 1024,
       "minLength": 1
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-tls-certificate-checker-22efedc5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)