SSL Certificate API — live TLS handshake, not scanner data.

Issuer, subject, validity dates, SANs, serial number and days until expiry for any domain, read from a real TLS handshake on port 443.

1,000 requests a month freeNo credit cardLive TLS handshake
Try
5 free live lookups left today
Loading an example…
Loading a cached example…
Live lookups run the same API your key calls.
Get the same JSON in your code. 1,000 requests a month free.Get free API key

What you get

Live handshake

The API connects to port 443 and reads the certificate the server presents. Results are cached for up to 6 hours.

Expiry as a number

days_until_expiry is an integer. Alert when it drops below your threshold, no date math.

Full SAN list

Every Subject Alternative Name on the certificate, to check it covers the hostnames you expect.

What's really deployed

The certificate is returned even if it's expired, self-signed or issued for another name.

Response fields

GET/domain/{domain}/ssl returns one JSON object. The same object is the ssl key of /lookup/{domain}.

FieldTypeMeaning
issuerstringIssuer DN (RFC 4514), e.g. CN=R11,O=Let's Encrypt,C=US
subjectstringSubject DN (RFC 4514)
valid_from / valid_tostringISO 8601 timestamps
days_until_expiryintegerNegative once expired
serial_numberstringCertificate serial
sansstring[]Every Subject Alternative Name on the certificate
signature_algorithmstringe.g. sha256WithRSAEncryption or ecdsa-with-SHA384
errorstringOnly when no certificate could be read
Example response for stripe.com (arrays shortened)
{
  "issuer": "CN=DigiCert G5 TLS ECC SHA384 2021 CA1,O=DigiCert\\, Inc.,C=US",
  "subject": "CN=stripe.com,O=Stripe\\, LLC,L=South San Francisco,ST=California,C=US,2.5.4.5=4675506,2.5.4.15=Private Organization,1.3.6.1.4.1.311.60.2.1.2=Delaware,1.3.6.1.4.1.311.60.2.1.3=US",
  "valid_from": "2026-09-24T00:00:00+00:00",
  "valid_to": "2026-12-10T23:59:59+00:00",
  "days_until_expiry": 69,
  "serial_number": "1939952089730671370756115214599670534",
  "sans": [
    "stripe.com",
    "www.stripe.com"
  ],
  "signature_algorithm": "ecdsa-with-SHA384"
}

What people build with it

Expiry alerting

A daily job over your domains; alert at 30 days, escalate at 7. The free tier covers about 30 domains a day.

Compliance checks

Review issuers and signature algorithms across your hosts.

SAN coverage

Confirm a certificate covers a new hostname before it goes live.

CA migration tracking

Track the issuer across your fleet to confirm a move between CAs finished.

Customer domain health

Check certificates on custom domains your customers connect, and catch failed renewals.

Third-party monitoring

Watch the certificates of critical vendors and alert on an unexpected issuer change.

Pricing

One key covers every endpoint, including /lookup with all five signals in one call. Billed monthly through RapidAPI.

BASIC$01,000 requests/mo, no card
PRO$9.9950,000 requests/mo
ULTRA$39.99500,000 requests/mo
MEGA$149.995,000,000 requests/mo

Frequently asked questions

Is your SSL Certificate API free?

Yes. The free tier includes 1,000 requests a month with no credit card. Paid plans start at $9.99/mo for 50,000 requests.

Is the data from a live TLS handshake or a cached scanner?

A live handshake. An uncached request connects to port 443 of the domain and reads the certificate it presents. Successful results are cached for up to 6 hours.

What fields are returned?

issuer, subject, valid_from, valid_to, days_until_expiry, serial_number, sans (every name on the certificate) and signature_algorithm.

Does this work for wildcard certs?

Yes. Wildcard names appear in sans, for example *.example.com.

Does it validate the certificate chain?

No. It returns whatever certificate the server presents, even if it's expired, self-signed or issued for another name, so you see what is actually deployed. Use days_until_expiry, subject and sans to judge it.

What about Certificate Transparency events?

This endpoint returns the certificate deployed now, not CT log history. For names that appear in certificate transparency logs, use the subdomain endpoint, which reads crt.sh and certspotter.

Can I check certs that aren't deployed publicly?

No. The API connects from the internet to port 443, so it only sees certificates on publicly reachable hosts. For internal hosts, run openssl s_client inside your own network.

What's the rate limit?

Limits are monthly, per plan: 1,000 requests on BASIC, 50,000 on PRO, 500,000 on ULTRA and 5,000,000 on MEGA. On paid plans, requests over the quota are billed at the overage rate.