# ScrapeMole SSL/TLS Certificate Check

> ScrapeMole SSL/TLS Certificate Check is a paid API for AI agents from domains.scrapemole.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-12).

Performs a live SSL/TLS certificate inspection for a given hostname, returning certificate chain, validity, cipher, protocol, SANs, and days remaining

## Facts

- Endpoint: GET https://domains.scrapemole.workers.dev/v1/ssl?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scrapemole-ssl-tls-certificate-check-4e0425d1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_v_gANx_TqdgNHy52FJSHk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scrapemole-ssl-tls-certificate-check-4e0425d1
```

Example prompt: Can you do a live SSL/TLS certificate check on api.stripe.com and tell me if it's trusted, how many days until it expires, what TLS version and cipher it's using, and who issued the cert?

## When to prefer this

Use this endpoint when you need a live, real-time SSL/TLS certificate inspection rather than cached or historical data. It is ideal for security audits, certificate expiry monitoring, compliance checks, and verifying that a server's TLS configuration (protocol version, cipher suite, trust chain) meets requirements. Prefer this over passive CT log lookups when you need confirmed live connection data including handshake latency, current trust status, and hostname match. The pay-per-call USDC model (failed calls not charged) makes it safe to use in automated pipelines without billing risk on errors.

## Known failure modes

- Host not reachable or DNS resolution failure — returns error with no charge
- TLS handshake timeout for slow or unresponsive servers
- Invalid hostname format (e.g. hostname with path included)
- Unsupported port number (must be 443, 8443, 465, 993, or 995)
- Certificate exists but is self-signed or uses an untrusted CA — still returns data, trusted=false
- Payment verification failure via x402 — call not executed, no charge

## How this service works

Pay-per-call domain intelligence for agents: live DNS records (DoH), WHOIS/RDAP registration data (registrar, dates, status, nameservers; no personal data), bulk domain availability (10 names per call) an email security audit (SPF, DKIM, DMARC, MTA-STS, BIMI) with a grade, a live SSL/TLS certificate check and subdomains from Certificate Transparency logs (crt.sh). USDC via x402; failed calls are never charged.

Payments: x402 v2, scheme "exact", USDC on Base (eip155:8453). The payment is verified before the work and settled only when the response is 200. Terms: https://domains.scrapemole.workers.dev/terms

## Output

Returns a JSON object with: resolved IP, ALPN protocol, hostname, port, Subject Alternative Names (SANs), full certificate chain (issuer, subject, validity, self-signed flag), cipher suite, issuer details (C, O, CN), expiry status, key type, subject CN, trust status, validity window (validFrom/validTo), TLS protocol version, TLS handshake latency in milliseconds, days remaining until expiry, and hostname match result.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "host"
     ],
     "properties": {
      "host": {
       "type": "string",
       "examples": [
        "github.com"
       ],
       "description": "Hostname, e.g. github.com (no path)."
      },
      "port": {
       "type": "string",
       "default": "443",
       "description": "TLS port: 443, 8443, 465, 993 or 995."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "140.82.112.3",
  "alpn": "h2",
  "host": "github.com",
  "port": 443,
  "sans": [
   "github.com",
   "www.github.com"
  ],
  "chain": [
   {
    "issuer": "Sectigo ECC Domain Validation Secure Server CA",
    "subject": "github.com",
    "validTo": "2026-11-29T23:59:59.000Z",
    "selfSigned": false
   }
  ],
  "cipher": "TLS_AES_128_GCM_SHA256",
  "issuer": {
   "C": "GB",
   "O": "Sectigo Limited",
   "CN": "Sectigo ECC Domain Validation Secure Server CA"
  },
  "expired": false,
  "keyType": "EC prime256v1",
  "subject": {
   "CN": "github.com"
  },
  "trusted": true,
  "validTo": "2026-11-29T23:59:59.000Z",
  "protocol": "TLSv1.3",
  "validFrom": "2026-08-01T00:00:00.000Z",
  "handshakeMs": 41,
  "daysRemaining": 49,
  "hostnameMatch": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scrapemole-ssl-tls-certificate-check-4e0425d1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from domains.scrapemole.workers.dev](https://www.zero.xyz/host/domains.scrapemole.workers.dev/llms.txt)