# Sentinel SSL Certificate & TLS Handshake Grader

> Sentinel SSL Certificate & TLS Handshake Grader is a paid API for AI agents from sentinel.rootstuff.io, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Retrieves the TLS certificate details and handshake security grade for a given public hostname on port 443

## Facts

- Endpoint: GET https://sentinel.rootstuff.io/x402/ssl
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sentinel-ssl-certificate-tls-handshake-grader-738e7344
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QS9HCnkXtHvDBHI3a92BP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sentinel-ssl-certificate-tls-handshake-grader-738e7344
```

Example prompt: Can you check the TLS certificate and SSL handshake grade for api.stripe.com — I want to know if its certificate is valid and how strong the handshake configuration is?

## When to prefer this

Use this endpoint when you need a fast, per-host TLS certificate inspection and handshake grading without setting up local tooling like openssl or ssllabs. It is ideal for agent workflows that need to programmatically audit SSL health, detect certificate expiry, or validate TLS configuration for a specific public hostname. Prefer it over full-page security scanners when you only need certificate and handshake data rather than HTTP header or content analysis (use the sibling security-header endpoint for that).

## Known failure modes

- Host is unreachable or does not have port 443 open — connection timeout or refused error
- Private or non-public hostname provided — rejected as only public hosts are supported
- Invalid hostname format — input validation error
- Self-signed or expired certificate — may return low grade and flagged errors
- SNI mismatch or certificate chain issues — reflected in grade with details

## How this service works

TLS certificate and handshake grade for a host

## Output

Returns the TLS certificate details (issuer, subject, expiry, chain validity) and a security grade for the handshake (covering protocol version, cipher suite strength, and configuration quality) for the specified hostname on port 443.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "host": {
   "type": "string",
   "description": "Hostname to connect to on port 443. Public hosts only."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sentinel-ssl-certificate-tls-handshake-grader-738e7344/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sentinel.rootstuff.io](https://www.zero.xyz/host/sentinel.rootstuff.io/llms.txt)