SSL Certificate Inspector API

expiry SANs issuer cipher suite TLS version A–F grade

One HTTPS GET returns everything you need to know about a domain's SSL certificate. Monitor cert expiry in CI, audit thousands of domains from a script, or wire it into your on-call runbook — no slow web UIs, no browser headless overhead.

Get Free API Key → Upgrade to Pro — $9/mo → Try it live ↓

Expiry countdown days_remaining in every response — alert before your users see the browser warning.

SANs extracted Every Subject Alternative Name listed — confirm wildcard coverage without openssl CLI.

TLS version + cipher Protocol (TLS 1.3 / 1.2) and cipher suite returned — catch downgrade risks automatically.

Letter grade A/B/C/F grading based on expiry + protocol — build dashboards that highlight at-risk certs.

Zero dependencies Pure stdlib ssl. No OpenSSL binaries, no headless browser, no puppeteer.

SNI correct Server Name Indication handled properly — works on shared-IP hosts and CDN edges.

Try it live

No API key needed for the live demo — up to 10 requests/min per IP.

Quick start

curl "https://kiprio.com/v1/ssl?domain=example.com" \
  -H "X-API-Key: $KIPRIO_KEY"

import requests

resp = requests.get(
    "https://kiprio.com/v1/ssl",
    params={"domain": "example.com"},
    headers={"X-API-Key": "kpr_..."},
)
cert = resp.json()
print(f"Grade: {cert['grade']} — expires in {cert['days_remaining']} days")

const res = await fetch("https://kiprio.com/v1/ssl?domain=example.com", {
  headers: { "X-API-Key": "kpr_..." },
});
const cert = await res.json();
console.log(`Grade: ${cert.grade} — expires in ${cert.days_remaining} days`);

{
  "domain": "example.com",
  "valid": true,
  "expires_at": "2027-01-01T00:00:00Z",
  "days_remaining": 250,
  "issuer": "Let's Encrypt",
  "subject": "example.com",
  "sans": ["*.example.com", "example.com"],
  "chain_depth": 2,
  "protocol": "TLSv1.3",
  "cipher": "TLS_AES_256_GCM_SHA384",
  "grade": "A",
  "tier": "pro"
}

Endpoints

Method	Path	Auth	Notes
GET	`/v1/ssl?domain=`	X-API-Key	Full cert report. 10s timeout.
GET	`/v1/ssl/demo?domain=`	none	IP-rate-limited. 10 req/min per IP.
GET	`/v1/ssl/health`	none	Service health.

Grade logic

Grade	Condition
A	Valid + TLS 1.3 + >60 days remaining
B	Valid + TLS 1.2+ + >30 days remaining
C	Valid but expiring within 30 days
F	Expired, invalid cert, or verification failure

Pricing

Tier	Quota	Price
free	30 checks/day	$0
pro	10,000 checks/month	$9/mo
business	100,000 checks/month	$39/mo

In a monitoring script

#!/bin/bash
# Alert if any domain's cert expires within 14 days
DOMAINS=("api.example.com" "app.example.com" "admin.example.com")
for domain in "${DOMAINS[@]}"; do
  result=$(curl -s "https://kiprio.com/v1/ssl?domain=$domain" \
    -H "X-API-Key: $KIPRIO_KEY")
  days=$(echo "$result" | python3 -c "import sys,json; print(json.load(sys.stdin)['days_remaining'])")
  if [ "$days" -lt 14 ]; then
    echo "WARN: $domain expires in ${days}d"
  fi
done

Built by kiprio.com · Task #446 · SNI-correct, 10s timeout. We never store certificate contents.