# Mekler AI TLS Certificate Inspector

> Mekler AI TLS Certificate Inspector is a paid API for AI agents from api.mekler.ai, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-29).

Inspects a public host on TCP port 443 for TLS certificate validity, expiry, DNS names, fingerprint, and negotiated cipher/version details

## Facts

- Endpoint: POST https://api.mekler.ai/v1/web/tls/inspect-certificate?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/mekler-ai-tls-certificate-inspector-ca597507
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_5-gDj-YzUZZKb0JeCUgEp

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability mekler-ai-tls-certificate-inspector-ca597507 -d '<json body>'
```

Example prompt: Can you inspect the TLS certificate for api.example.com — I need to know if it's currently valid, when it expires, what cipher and TLS version are being used, and whether it passes hostname verification?

## When to prefer this

Choose this endpoint when you need a quick, structured TLS certificate inspection for a public hostname — specifically to check expiry, verify trust, retrieve DNS SANs, fingerprint, and negotiated TLS version/cipher — without needing HTTP scanning, OCSP revocation checking, or a full security audit. It is ideal for automated certificate monitoring, pre-deployment checks, and lightweight TLS diagnostics in agentic workflows where cost and latency matter.

## Known failure modes

- Hostname does not resolve in public DNS — no handshake possible
- Host unreachable or connection refused on port 443 — timeout or connection error
- Certificate fails verification — triggers one additional unverified diagnostic handshake; certificate remains untrusted and verification_error_code is populated
- Invalid hostname format exceeding 253 characters — input validation error
- Host is not a public DNS host (private IP or internal name) — not supported
- Service-side network issues may cause transient failures

## How this service works

Inspect a public host on TCP port 443 for certificate expiry, DNS names, fingerprint, runtime CA/hostname validation and negotiated TLS details. A failed certificate check triggers one unverified diagnostic handshake and remains untrusted. No HTTP scanning, revocation or exhaustive security assessment.

## Output

Returns a JSON object containing: port (443), negotiated cipher suite, SHA-256 certificate fingerprint, overall status, hostname, verified boolean, DNS SANs array, not_before and not_after timestamps, time_valid boolean, seconds_until_expiry, observed_at timestamp, TLS version, verification_error_code (if any), and a limitations array describing scope constraints of the check.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "hostname": {
   "type": "string",
   "maxLength": 253
  },
  "request_id": {
   "type": "string",
   "pattern": "^[A-Za-z0-9_-]{16,64}$"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "port": 443,
  "cipher": "TLS_AES_256_GCM_SHA384",
  "sha256": "0000000000000000000000000000000000000000000000000000000000000000",
  "status": "ok",
  "hostname": "mekler.ai",
  "verified": true,
  "dns_names": [
   "mekler.ai"
  ],
  "not_after": "2027-01-01T00:00:00+00:00",
  "not_before": "2026-10-01T00:00:00+00:00",
  "time_valid": true,
  "limitations": [
   "One remote handshake from the deployed service; DNS, certificate and routing can change.",
   "verified uses the runtime CA store and hostname validation. Certificate failure triggers one unverified handshake to collect diagnostics; it does not make the certificate trusted.",
   "No revocation/OCSP, certificate-transparency, exhaustive protocol/cipher scan or overall security guarantee. Only public DNS hosts on port 443; no HTTP request is sent."
  ],
  "observed_at": "2026-10-20T00:00:00Z",
  "tls_version": "TLSv1.3",
  "seconds_until_expiry": 6307200,
  "verification_error_code": null
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/mekler-ai-tls-certificate-inspector-ca597507/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.mekler.ai](https://www.zero.xyz/host/api.mekler.ai/llms.txt)