# netintel TLS Certificate & Security Inspector

> netintel TLS Certificate & Security Inspector is a paid API for AI agents from netintel.x.c00l.site, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-15).

Inspects a domain's TLS certificate, handshake details, and HTTP security headers, returning a graded security report with certificate validity, cipher suite, and expiry information.

## Facts

- Endpoint: POST https://netintel.x.c00l.site/tls
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-tls-certificate-security-inspector-6df1301a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_HrUOqp_d-a_z2wx-ePyUN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-tls-certificate-security-inspector-6df1301a -d '<json body>'
```

Example prompt: Can you inspect the TLS certificate and security headers for github.com — I want to see the grade, cipher suite, TLS version, certificate expiry, and who issued the cert?

## When to prefer this

Choose this endpoint when you need a combined TLS certificate inspection plus HTTP security headers grade in a single call, without setting up an account or API key. It is ideal for one-off audits, automated security monitoring pipelines, or vendor due-diligence checks where you want raw certificate metadata (issuer, expiry, SANs, cipher suite) alongside a scored security headers report. Prefer it over browser-based tools or paid observatory services when you need programmatic, pay-per-call access with no subscription overhead.

## Known failure modes

- Domain does not exist or is unreachable — connection timeout or DNS failure
- Domain has no TLS listener on port 443 — handshake failure
- Self-signed or untrusted certificate — may return low grade with error details
- Payment not included or insufficient — x402 payment required response
- Malformed hostname input — validation error

## How this service works

Paid-per-call network intelligence API: DNS with DNSSEC, email deliverability, TLS certificate inspection, IP/ASN lookup and DNS propagation. From $0.002 a call over x402. No account, no API key.

## Output

Returns a JSON object with: an overall TLS grade (e.g. 'A'), handshake details (ALPN protocol, cipher suite, negotiated TLS version), certificate details (issuer, subject, serial number, validity window, days until expiry, expiry flag, public key algorithm and curve, subject alt names, signature algorithm), and security headers assessment (grade, numeric score, per-header penalty reasons).

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "grade": "A",
  "handshake": {
   "alpn": "h2",
   "cipherSuite": "ECDHE-ECDSA-AES128-GCM-SHA256",
   "negotiatedVersion": "TLSv1.2"
  },
  "certificate": {
   "issuer": {
    "commonName": "Sectigo ECC DV"
   },
   "subject": {
    "commonName": "github.com"
   },
   "validity": {
    "expired": false,
    "notAfter": "2026-02-05T23:59:59.000Z",
    "daysUntilExpiry": 189
   },
   "publicKey": {
    "curve": "P-256",
    "algorithm": "EC"
   },
   "serialNumber": "72010E03F4A067FE4E796266430718F6",
   "subjectAltNames": [
    "github.com",
    "www.github.com"
   ],
   "signatureAlgorithm": {
    "name": "ecdsa-with-SHA256"
   }
  },
  "securityHeaders": {
   "grade": "A",
   "score": 88,
   "reasons": [
    {
     "header": "…",
     "points": -5,
     "reason": "…"
    }
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-tls-certificate-security-inspector-6df1301a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.x.c00l.site](https://www.zero.xyz/host/netintel.x.c00l.site/llms.txt)