SSL/TLS Checker API

The ssltest.com API runs a full SSL/TLS scan for a host and returns a JSON report: certificate chain, protocol and cipher support, known vulnerabilities, HSTS, CAA, revocation status, and a letter grade. No API key, no signup.

Every check is a full scan (no quick/extended toggle) and results are cached for 24 hours, keyed by host, port, and protocol.

Quick start

curl "https://api.ssltest.com/v1/check?host=example.com"

A cold check has nothing cached yet, so the first call returns 202 with a poll URL. Poll it (or use the SSE stream below) until the report is ready:

{
  "status": "processing",
  "report_id": "a1b2c3d4e5f60718293a",
  "poll": "/v1/check?host=example.com"
}

Endpoints

Endpoint	Description
GET /v1/check?host=	Cache-or-scan report (JSON)
GET /v1/check/stream?host=	Live scan progress (SSE)

Target format

host accepts a bare host (example.com), a host with an explicit port (example.com:8443), or protocol/host[:port] for a non-HTTPS check (smtp/mail.example.com, imap/mail.example.com:993). A protocol and port can also be passed as separate proto=/port= query params instead of the combined form.

Direct-TLS protocols: https, ftps, smtps, pop3s, imaps, ldaps. STARTTLS protocols: smtp, smtp-submission, imap, pop3, ftp, ldap, xmpp, nntp. Each has a default port used when none is given.

Response

Returned once the report is ready (fields trimmed for brevity):

{
  "host": "example.com",
  "port": 443,
  "protocol": "https",
  "scanned_at": 1753272000,
  "cached": true,
  "primary_ip": "93.184.216.34",
  "consistent": true,
  "days_until_expiry": 207,
  "primary_result": {
    "hostname": "example.com",
    "port": 443,
    "success": true,
    "chain_valid": true,
    "hostname_match": true,
    "connection": {
      "protocol": "TLSv1.3",
      "cipher": "TLS_AES_128_GCM_SHA256"
    }
  },
  "ips": {
    "93-184-216-34": {
      "ip": "93.184.216.34",
      "grade": {
        "grade": "A"
      }
    }
  }
}

Error responses

Code	Error	Meaning
422	`invalid_target`	host is missing, or does not parse as a hostname/IP, an optional port, and a supported protocol
429	`rate_limited`	Too many requests. Check the Retry-After header.

Streaming events

GET /v1/check/stream?host=... enqueues a scan the same way /v1/check does, then streams named Server-Sent Events until the report is ready:

Event	Payload
`progress`	data: {progress, status} while the scan runs
`result`	data: the finished report, same shape as /v1/check
`error`	data: {error} - rate limited, timed out, or failed

curl -N "https://api.ssltest.com/v1/check/stream?host=example.com"

MCP

The same check is also exposed as an MCP tool (ssl_check) over Streamable HTTP at api.ssltest.com/mcp. See mcp.ssltest.com for connection instructions.

Terms and policies

Use of the API is subject to the ssltest.com Terms of Service and Privacy Policy. For abuse reports see Abuse; host owners can opt out.