# SSL/TLS Certificate Check & Expiry Monitor

> SSL/TLS Certificate Check & Expiry Monitor is a paid API for AI agents from agent-data.centorprat.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Performs passive TLS handshakes on given hosts/URLs and returns certificate validity, expiry status, issuer, SANs, and TLS version, with configurable expiry alerts via webhook.

## Facts

- Endpoint: POST https://agent-data.centorprat.workers.dev/tools/ssl-certificate-expiry-check?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ssl-tls-certificate-check-expiry-monitor-5a7a1ed8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bO4cnmMJQ5YeR2G8iewVM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ssl-tls-certificate-check-expiry-monitor-5a7a1ed8 -d '<json body>'
```

Example prompt: Check the SSL certificates on github.com, api.mycompany.com, and mail.example.com:993 — flag anything expiring within 30 days as a warning and within 7 days as critical, and only show me the ones with problems.

## When to prefer this

Choose this endpoint when you need a lightweight, keyless passive TLS inspection — no client certificates or auth keys required. Ideal for scheduled certificate expiry monitoring across a small set of hosts (up to 3 per call), especially when you want configurable warn/critical day thresholds and webhook-based alerting. Prefer this over full SSL scanner tools when you only need validity status, expiry timing, issuer, and SANs rather than deep vulnerability scanning (e.g., cipher suite weakness analysis).

## Known failure modes

- Host unreachable or connection timeout — returns 'unreachable' signal for that host
- Invalid or self-signed certificate — returns 'invalid' signal
- Port not specified defaults to 443; wrong port causes connection failure
- Input array exceeds 3 hosts — rejected by schema validation
- Non-HTTPS scheme provided — URL stripped to host and assumed port 443
- Transient network errors may cause intermittent unreachable results

## How this service works

Pay-per-call data and tools for AI agents, $0.002-0.01 per call in USDC via x402 (Base, Polygon or Solana), no account or API key; MAX tiers ($0.05-0.25) run deeper jobs. Agent toolkit: web search, search + read top pages, any page as clean markdown with a prompt-injection check, which-x402-API-to-call recommender, seller check. Data: Google Maps places with contacts, YouTube video data and transcripts, job listings (Indeed, LinkedIn, 13 boards), Google Ads Transparency, TikTok comments, Pinterest, Airbnb, Redfin, AliExpress, app stores, live sports, website and SEO checks, Shopify store tech stacks, and onchain token / address risk checks.

## Output

For each host, returns a structured report including: certificate validity status signal (valid, expiring-soon, expiring-very-soon, expired, invalid, or unreachable), number of days until expiry, certificate issuer and subject, Subject Alternative Names (SANs), and the TLS version negotiated during the handshake. Failed/unreachable hosts are reported but not charged.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "hosts": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "maxItems": 3,
   "description": "e.g. [\"github.com\", \"https://your-site.com\", \"mail.example.com:993\"]. A URL is reduced to host; add :port for non-443. One report per host."
  },
  "warnDays": {
   "type": "integer",
   "description": "Certificates expiring within this many days are flagged 'expiring-soon'."
  },
  "criticalDays": {
   "type": "integer",
   "description": "Certificates expiring within this many days are flagged 'expiring-very-soon'."
  },
  "onlyProblems": {
   "type": "boolean",
   "description": "On: return only expiring/expired/invalid/unreachable hosts (ideal for scheduled alerting)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "host": "github.com",
    "port": 443,
    "valid": true,
    "issuer": "Sectigo Limited",
    "signal": "valid",
    "target": "github.com",
    "notAfter": "Nov 29 23:59:59 2026 GMT",
    "sanCount": 2,
    "checkedAt": "2026-10-23T11:31:49+00:00",
    "notBefore": "Sep  1 00:00:00 2026 GMT",
    "reachable": true,
    "daysUntilExpiry": 37,
    "subjectAltNames": [
     "github.com",
     "www.github.com"
    ],
    "subjectCommonName": "github.com"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ssl-tls-certificate-check-expiry-monitor-5a7a1ed8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-data.centorprat.workers.dev](https://www.zero.xyz/host/agent-data.centorprat.workers.dev/llms.txt)