# SiteCheck SSL Certificate Checker

> SiteCheck SSL Certificate Checker is a paid API for AI agents from api.sitecheck-api.workers.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-20).

Retrieves SSL/TLS certificate details and HTTPS status for up to 10 hostnames using Certificate Transparency logs

## Facts

- Endpoint: GET https://api.sitecheck-api.workers.dev/api/ssl?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-ssl-certificate-checker-fca2aeb3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_OZ3FwYFg7y6C-viNjz6Tl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-ssl-certificate-checker-fca2aeb3
```

Example prompt: Can you check the SSL certificate status for api.mycompany.com and shop.mycompany.com — I want to know who issued them, when they expire, and whether HSTS is enabled?

## When to prefer this

Use this endpoint when you need programmatic, bulk SSL certificate intelligence sourced from Certificate Transparency logs rather than a live TLS handshake — ideal for monitoring certificate expiry across multiple domains in one call, checking HSTS configuration, verifying issuer identity, and detecting wildcard certs. Prefer it over live-handshake tools when you want historical CT log data or need to check up to 10 hosts simultaneously at low cost ($0.001/call).

## Known failure modes

- Invalid or non-public hostname returns an error or missing result for that host
- Host with no certificate in CT logs may return empty certificate data
- Network timeout reaching the host for the HTTPS HEAD request
- Exceeding the 10-host limit causes a validation error
- Newly issued certificates may not yet appear in CT logs
- CT log APIs (certspotter/crt.sh) rate limiting or downtime causing fallback or failure

## How this service works

TLS certificate expiry for up to 10 hostnames: the issuer, validity dates, days left, all DNS names and a status (ok, expiring within 14 days, expired, none found). Read from Certificate Transparency logs (CertSpotter, crt.sh as fallback), so it is the newest valid certificate issued for each name, not the one the server presents; the answer also says whether https answers and its HSTS header. Public hostnames only.

## Output

Returns a JSON object with a per-host breakdown including: certificate issuer, notBefore/notAfter validity dates, days remaining, covered DNS names, wildcard flag, CT log source used (certspotter or crt.sh), HTTPS HEAD response status code, HSTS header value, and DNS resolution status. Also includes a top-level note about CT log behaviour, the data basis, and the timestamp of the check.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "hosts"
     ],
     "properties": {
      "hosts": {
       "type": "string",
       "description": "Comma-separated public hostnames, 1 to 10, e.g. github.com,example.com"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "note": "A certificate that the host serves is normally the newest one issued for its name; a replaced certificate can show here a little before the server uses it. Certificates issued for a name that is not on the host's list are not shown.",
  "basis": "Certificate Transparency logs (newest valid certificate for the name), not the live TLS handshake",
  "count": 2,
  "source": "api.certspotter.com (crt.sh as fallback) and an HTTPS HEAD request to each host",
  "results": [
   {
    "host": "github.com",
    "https": {
     "hsts": "max-age=31536000; includeSubdomains; preload",
     "status": 200,
     "answers": true
    },
    "status": "ok",
    "ctSource": "certspotter",
    "certificate": {
     "issuer": "Sectigo",
     "daysLeft": 88,
     "dnsNames": [
      "garage.github.com",
      "gist.github.com",
      "github.com"
     ],
     "notAfter": "2027-01-11T23:59:59Z",
     "wildcard": false,
     "notBefore": "2026-10-14T00:00:00Z"
    }
   },
   {
    "host": "example.com",
    "https": {
     "hsts": null,
     "status": 200,
     "answers": true
    },
    "status": "ok",
    "ctSource": "certspotter",
    "certificate": {
     "issuer": "SSL.com",
     "daysLeft": 71,
     "dnsNames": [
      "*.example.com",
      "example.com"
     ],
     "notAfter": "2026-12-25T22:56:35Z",
     "wildcard": true,
     "notBefore": "2026-09-26T22:49:11Z"
    }
   }
  ],
  "checkedAt": "2026-10-15T06:45:34.578Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-ssl-certificate-checker-fca2aeb3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.sitecheck-api.workers.dev](https://www.zero.xyz/host/api.sitecheck-api.workers.dev/llms.txt)