SSL Certificate API — live TLS handshake, not scanner data.
Issuer, subject, validity dates, SANs, serial number and days until expiry for any domain, read from a real TLS handshake on port 443.
// Run a lookup to see the JSON response
Long arrays are shortened here. The API returns them in full.
curl "https://domain-intelligence-api.p.rapidapi.com/domain/example.com/ssl" \
-H "X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com" \
-H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY"
import requests
DOMAINS = ["yourapp.com", "api.yourapp.com", "example.com"]
ALERT_DAYS = 30
headers = {
"X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
}
for domain in DOMAINS:
data = requests.get(
f"https://domain-intelligence-api.p.rapidapi.com/domain/{domain}/ssl",
headers=headers, timeout=15,
).json()
days = data.get("days_until_expiry")
if days is None:
print(f"{domain}: could not read a certificate")
elif days <= ALERT_DAYS:
print(f"{domain}: ALERT - expires in {days} days ({data['valid_to']})")
else:
print(f"{domain}: OK - {days} days left")
// Node 18+ (built-in fetch)
const res = await fetch(
"https://domain-intelligence-api.p.rapidapi.com/domain/example.com/ssl",
{ headers: {
"X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
} }
);
console.log(await res.json());
<?php
$ch = curl_init("https://domain-intelligence-api.p.rapidapi.com/domain/example.com/ssl");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
"X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com",
"X-RapidAPI-Key: YOUR_RAPIDAPI_KEY",
]);
$data = json_decode(curl_exec($ch), true);
print_r($data);
What you get
Live handshake
The API connects to port 443 and reads the certificate the server presents. Results are cached for up to 6 hours.
Expiry as a number
days_until_expiry is an integer. Alert when it drops below your threshold, no date math.
Full SAN list
Every Subject Alternative Name on the certificate, to check it covers the hostnames you expect.
What's really deployed
The certificate is returned even if it's expired, self-signed or issued for another name.
Response fields
GET/domain/{domain}/ssl returns one JSON object. The same object is the ssl key of /lookup/{domain}.
| Field | Type | Meaning |
|---|---|---|
| issuer | string | Issuer DN (RFC 4514), e.g. CN=R11,O=Let's Encrypt,C=US |
| subject | string | Subject DN (RFC 4514) |
| valid_from / valid_to | string | ISO 8601 timestamps |
| days_until_expiry | integer | Negative once expired |
| serial_number | string | Certificate serial |
| sans | string[] | Every Subject Alternative Name on the certificate |
| signature_algorithm | string | e.g. sha256WithRSAEncryption or ecdsa-with-SHA384 |
| error | string | Only when no certificate could be read |
Example response for stripe.com (arrays shortened)
{
"issuer": "CN=DigiCert G5 TLS ECC SHA384 2021 CA1,O=DigiCert\\, Inc.,C=US",
"subject": "CN=stripe.com,O=Stripe\\, LLC,L=South San Francisco,ST=California,C=US,2.5.4.5=4675506,2.5.4.15=Private Organization,1.3.6.1.4.1.311.60.2.1.2=Delaware,1.3.6.1.4.1.311.60.2.1.3=US",
"valid_from": "2026-09-24T00:00:00+00:00",
"valid_to": "2026-12-10T23:59:59+00:00",
"days_until_expiry": 69,
"serial_number": "1939952089730671370756115214599670534",
"sans": [
"stripe.com",
"www.stripe.com"
],
"signature_algorithm": "ecdsa-with-SHA384"
}
What people build with it
Expiry alerting
A daily job over your domains; alert at 30 days, escalate at 7. The free tier covers about 30 domains a day.
Compliance checks
Review issuers and signature algorithms across your hosts.
SAN coverage
Confirm a certificate covers a new hostname before it goes live.
CA migration tracking
Track the issuer across your fleet to confirm a move between CAs finished.
Customer domain health
Check certificates on custom domains your customers connect, and catch failed renewals.
Third-party monitoring
Watch the certificates of critical vendors and alert on an unexpected issuer change.
Pricing
One key covers every endpoint, including /lookup with all five signals in one call. Billed monthly through RapidAPI.
Frequently asked questions
Is your SSL Certificate API free?
Yes. The free tier includes 1,000 requests a month with no credit card. Paid plans start at $9.99/mo for 50,000 requests.
Is the data from a live TLS handshake or a cached scanner?
A live handshake. An uncached request connects to port 443 of the domain and reads the certificate it presents. Successful results are cached for up to 6 hours.
What fields are returned?
issuer, subject, valid_from, valid_to, days_until_expiry, serial_number, sans (every name on the certificate) and signature_algorithm.
Does this work for wildcard certs?
Yes. Wildcard names appear in sans, for example *.example.com.
Does it validate the certificate chain?
No. It returns whatever certificate the server presents, even if it's expired, self-signed or issued for another name, so you see what is actually deployed. Use days_until_expiry, subject and sans to judge it.
What about Certificate Transparency events?
This endpoint returns the certificate deployed now, not CT log history. For names that appear in certificate transparency logs, use the subdomain endpoint, which reads crt.sh and certspotter.
Can I check certs that aren't deployed publicly?
No. The API connects from the internet to port 443, so it only sees certificates on publicly reachable hosts. For internal hosts, run openssl s_client inside your own network.
What's the rate limit?
Limits are monthly, per plan: 1,000 requests on BASIC, 50,000 on PRO, 500,000 on ULTRA and 5,000,000 on MEGA. On paid plans, requests over the quota are billed at the overage rate.