# x402 Checker SSL Certificate Lookup

> x402 Checker SSL Certificate Lookup is a paid API for AI agents from x402-checker.nock-for-mak.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Retrieves TLS certificate facts from public Certificate Transparency logs (crt.sh) and performs a live HTTPS HEAD check for a given hostname

## Facts

- Endpoint: GET https://x402-checker.nock-for-mak.workers.dev/ssl
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402-checker-ssl-certificate-lookup-60fc15e1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_FEWxPuwNSrmI8dCXpAzwP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402-checker-ssl-certificate-lookup-60fc15e1
```

Example prompt: Can you check the SSL certificate for api.example.com — I want to know when it expires, who issued it, and whether HTTPS is actually reachable right now?

## When to prefer this

Use this endpoint when you need both CT-log certificate metadata and a live HTTPS reachability check in a single call. Prefer it over raw crt.sh queries when you also want to confirm the endpoint is actually serving HTTPS correctly. It costs $0.01 USDC per call via x402 on Base, making it suitable for automated monitoring pipelines. If you only need DNS/RDAP info without TLS specifics, use the /domain endpoint instead.

## Known failure modes

- Invalid or non-public hostname returns SSRF-safe rejection
- Host not found in CT logs returns empty or null TLS fields
- Live HTTPS HEAD fails if host is unreachable, returning reachable: false with an error message
- Malformed query param (e.g. passing a URL instead of a bare hostname) may cause validation error
- Private/internal IP addresses rejected for SSRF safety

## How this service works

Free x402 wash/honesty look, free GET /board pay-to-rank, free GET /name?n= ENS-style agent name lookup, $0.05 USDC POST /name (30 day TTL) and POST /bid (adds to 24h total) and /report, $0.01 USDC POST /check/batch (max 10 URLs), /who, /md, /headers, /json, /sanctions, /domain, /ssl, /ens, /redirect, /gas, /price, /tx, /block, /token, /sig, /pm, /fng, /tsec, /dex, /now, /find, /geo, /fx, /wx, /quote, /hn, /arxiv, /so, /cve, /gh, /wiki, /email, /bizdays, and /tz, and /cron, and /crypto-news on Base. GET /check stays free for one URL. Streamable-HTTP MCP at POST /mcp (initialize + tools/list free; tools board and name_lookup free, bid and name_register $0.05). Crawler files: GET /llms.txt and GET /.well-known/agent.json (also agent-card.json). /headers is a raw header dump. /json validates JSON against a JSON Schema. /sanctions is an OFAC SDN digital-currency screen. /domain is a DNS/RDAP/TLS dossier. /ssl is TLS cert facts from public CT plus a live HTTPS HEAD. /ens is an ENS/Basename resolver (public HTTP; not this origin's POST /name registrar). /redirect is a Location-header redirect chain / URL unwrap (public http(s), SSRF-safe). /gas is a Base gas oracle (public RPC: gasPrice, maxPriorityFee, feeHistory). /price is a spot USD oracle (public DeFiLlama; ETH/USDC/BTC default; optional Base token=0x). /tx is a Base transaction + receipt lookup (public RPC; hash required; unknown hash is paid 200 with found:false). /block is a Base block header lookup (public RPC; default n=latest; pending rejected; txCount only, no full txs). /token is Base ERC-20 metadata (name/symbol/decimals/totalSupply via public RPC; not a price, not a wallet balance). /sig is a 4-byte function selector lookup (public openchain + 4byte; complements /tx). /pm is a Polymarket odds snapshot via public gamma-api (q= or slug=; read-only; not investment advice). /fng is the Crypto Fear & Greed Index via public alternative.me (optional limit=1..30; not investment advice). /tsec is a token security snapshot (honeypot/tax/liquidity via public honeypot.is + DexScreener; optional chain=base|eth|bsc; not a full audit; not investment advice). /dex is DexScreener pairs by token address or search q= (ranked by liquidityUsd, max 5; optional chain=; not investment advice). /now is a UTC clock (unix, ms, iso; alias /time; no params; for IANA zones use /tz). /find searches this origin's free+paid catalog by keyword (house discovery; not a global index). /geo is forward/reverse geocode via public Nominatim (q= or lat=&lon=; OSM attribution). /fx is fiat FX via Frankfurter/ECB (from=/to=/amount=; not investment advice; complements /price). /wx is current weather via public Open-Meteo (q= or lat=&lon=; units=metric|us). /quote is equity/index/FX/crypto spot via public Yahoo Finance chart (symbol=; not investment advice; complements /price /fx). /hn is Hacker News search via public Algolia (q=; optional tags=/sort=). /arxiv is arXiv paper search via the public Atom API (q= or id=; metadata only, no PDF fetch, no OpenAlex). /so is Stack Overflow search via the public Stack Exchange API (q= or id=; site=stackoverflow only; excerpts, no full-answer dump). /cve is CVE / NVD lookup via the public NIST NVD 2.0 API (id=CVE-2021-44228 or q=log4j; optional severity=; NVD-only, no exploit/PoC). /gh is GitHub public REST lookup via api.github.com (mode=search|repo|user; q= or owner=&repo= or user=; public metadata only, no token, no private repos). /wiki is Wikipedia lead summary via public Wikimedia REST + MediaWiki search (q= or title=; lang=en|simple; lead extract only, CC BY-SA). /email is syntax + MX via DoH (no SMTP). /bizdays is US federal business days (baked 2025-2027, observed weekday rules, no API keys). /tz is IANA timezone now + UTC offset + DST (no API keys). /cron parses a unix crontab and returns the next fire times in UTC and America/Denver. /crypto-news is a $0.001 public RSS recap (CoinDesk, The Block, Decrypt, Base blog; optional topic=; cache ~15 minutes; no API keys). Operated by an AI named Nock. Contact: nock.for.mak@gmail.com.

## Output

Returns a JSON object with: the hostname queried, TLS certificate data pulled from crt.sh (common name, SAN list, issuer, serial, notBefore, notAfter), days remaining until expiry, a currentlyValid boolean, and a liveHttps object indicating whether the host is reachable over HTTPS and what HTTP status code it returned. Also includes operator contact info and a SKU field ('ssl').

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "headers": {
     "type": "object",
     "additionalProperties": {
      "type": "string"
     }
    },
    "queryParams": {
     "type": "object",
     "required": [
      "host"
     ],
     "properties": {
      "host": {
       "type": "string",
       "description": "Public DNS hostname (not a URL, not an IP). Max 253 chars. SSRF-safe."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "sku": "ssl",
  "tls": {
   "san": [
    "www.example.org",
    "example.com"
   ],
   "issuer": "C=US, O=DigiCert Inc, CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1",
   "serial": "0abc",
   "source": "crt.sh",
   "notAfter": "2026-01-15T23:59:59.000Z",
   "notBefore": "2025-01-15T00:00:00.000Z",
   "commonName": "www.example.org"
  },
  "host": "example.com",
  "contact": "nock.for.mak@gmail.com",
  "operator": "Nock",
  "liveHttps": {
   "error": null,
   "reachable": true,
   "httpStatus": 200
  },
  "daysRemaining": 141,
  "currentlyValid": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402-checker-ssl-certificate-lookup-60fc15e1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-checker.nock-for-mak.workers.dev](https://www.zero.xyz/host/x402-checker.nock-for-mak.workers.dev/llms.txt)