You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The SSL/TLS Security Analyzer API is a lightweight, developer-friendly REST API for analyzing SSL/TLS configurations of any domain or IP address. It provides security grading from A–F, detects weak ciphers and weak Diffie-Hellman parameters, checks supported protocols, validates certificates and certificate chains, enumerates cipher suites, monitors certificate expiry, and flags common vulnerabilities — all from a single HTTP request.
Whether you're building a security dashboard, monitoring system, compliance tool, or a certificate-expiry alerting pipeline, this API makes SSL/TLS checks seamless.
What's New in v0.0.2
5 new endpoints — /certificate, /expiry, /batch, /ciphers, /cipher/check
# Minimal scan
curl "https://ssl-tls-security-analyzer-api.p.rapidapi.com/analyze?domain=example.com"# Check certificate expiry
curl "https://ssl-tls-security-analyzer-api.p.rapidapi.com/expiry?domain=example.com"# Scan multiple domains at once
curl -X POST "https://ssl-tls-security-analyzer-api.p.rapidapi.com/batch" \
-H "Content-Type: application/json" \
-d '{"domains": ["example.com", "google.com", "github.com"]}'
Endpoints Overview
Method
Endpoint
Description
GET
/status
Health check and service info
GET/POST
/analyze
Full SSL/TLS security analysis (flagship)
GET/POST
/certificate
Deep certificate inspection and chain validation
GET
/expiry
Fast certificate expiry check for monitoring
GET/POST
/batch
Parallel analysis of up to 50 domains
GET
/ciphers
Enumerate supported cipher suites for TLS 1.2/1.3
GET
/cipher/check
Test whether a specific cipher suite is supported
Common Parameters
These parameters are shared across most endpoints:
Parameter
Type
Required
Default
Description
domain
string
✅ Yes
—
Target hostname or IP (e.g., example.com, 1.2.3.4). Also accepts host as alias.
port
int
❌ No
443
TCP port to connect to. Range: 1–65535.
timeout
int
❌ No
5
Per-connection timeout in seconds. Range: 1–15.
All endpoints return JSON. Errors include an error message and a machine-readable code field.
Endpoint 1: GET /status
Description
Health check endpoint. Returns the service status, version, whether openssl is available, the Python runtime version, server time, and uptime. Makes zero network calls — instant and free.
Flagship endpoint. Performs a comprehensive SSL/TLS security analysis of any hostname or IP address. Returns supported TLS protocol versions, all negotiated cipher suites, weak cipher detection, full parsed certificate details, certificate chain validation, hostname match verification, forward secrecy check, weak Diffie-Hellman detection, known vulnerability flags, and an overall letter grade from A to F. The grade uses a score-based heuristic with a transparent breakdown of every deduction in grade_notes.
{"error": "internal server error", "code": "INTERNAL_ERROR"}
Unexpected server error.
Endpoint 3: GET/POST /certificate
Description
Deep inspection of a server's SSL/TLS certificate and full certificate chain. Returns the complete leaf certificate (subject, issuer, common name, serial number, validity dates, expiry status, signature algorithm, Subject Alternative Names, key usage flags), the public key details (algorithm, bit size), the full certificate chain with chain-length count and a heuristic signing-order validation, self-signed detection, and hostname coverage verification (DNS SANs including wildcard support). This endpoint performs one handshake only — no protocol probing — making it the fastest way to inspect certificate health.
Query Parameters (GET)
Parameter
Type
Required
Default
Description
domain
string
✅ Yes
—
Target domain or hostname.
port
int
❌ No
443
Port to connect to.
timeout
int
❌ No
5
Connection timeout in seconds.
Request Body (POST)
{
"domain": "example.com",
"port": 443
}
Example GET Request
/certificate?domain=example.com
Example POST Request
POST /certificate
Content-Type: application/json
{
"domain": "example.com",
"port": 443
}
Could not retrieve the certificate (no cert returned, connection refused).
500
{"error": "internal server error", "code": "INTERNAL_ERROR"}
Unexpected server error.
Endpoint 4: GET /expiry
Description
Fast, single-handshake certificate expiry check designed for monitoring crons and certificate-expiry alerting services. Returns only the fields relevant to expiry monitoring: domain, common name, issuer, serial number, validity dates, days until expiry, and expired status. This is the cheapest and lightest endpoint in the entire API — one Python SSL handshake, no openssl probes, no protocol scanning. Results are cached for only 2 minutes (vs 5 minutes for other endpoints) so monitoring data stays fresh. Ideal for running on a daily or hourly cron schedule.
{"error": "internal server error", "code": "INTERNAL_ERROR"}
Unexpected server error.
Endpoint 5: GET/POST /batch
Description
Analyze up to 50 domains in parallel with a single API request. Each domain is scanned concurrently across 8 parallel workers. If a domain fails input validation (e.g. invalid hostname), it is returned as an error entry in the results — a single bad domain never fails the whole batch. Results are returned in the same order you submitted the domains. Each result in the array is a complete /analyze output (grade, protocols, ciphers, certificate, vulnerabilities, etc.) for that domain. This endpoint is ideal for bulk scanning, portfolio monitoring, and CI/CD certificate checks.
Query Parameters (GET)
Parameter
Type
Required
Default
Description
domains
string[]
✅ Yes
—
List of domains to scan. Repeat the parameter for multiple values. Max 50.
Number of domains that failed (invalid input or scan error)
results
Array of per-domain results, in request order. Each entry is either a full /analyze result or an error object with domain and error fields.
Error Responses
Code
Example
Meaning
400
{"error": "domains parameter is required", "code": "INVALID_DOMAINS"}
Empty domains list.
400
{"error": "batch limited to 50 domains per request", "code": "TOO_MANY_DOMAINS"}
More than 50 domains submitted.
400
{"error": "port must be an integer between 1 and 65535", "code": "INVALID_PORT"}
Invalid port value.
500
{"error": "internal server error", "code": "INTERNAL_ERROR"}
Unexpected server error.
Endpoint 6: GET /ciphers
Description
Enumerate all cipher suites a server supports for a given TLS version (TLS 1.2 or TLS 1.3) by testing every locally available cipher suite in parallel. The API builds a list of cipher suite names from the local openssl installation, then attempts a handshake for each one (up to limit attempts) using a thread pool of 8 parallel workers. Only suites the server actually accepts are returned in the supported array. This is the most resource-intensive endpoint — it makes dozens of TLS handshakes per call. Requires the openssl CLI on the server.
Query Parameters (GET)
Parameter
Type
Required
Default
Description
domain
string
✅ Yes
—
Target domain or hostname.
tls_version
string
❌ No
TLSv1.2
Which TLS version to test suites for. Accepts TLSv1.2 or TLSv1.3.
Test whether a server supports one specific cipher suite with a single TLS handshake. Returns supported: true if the server negotiated the cipher, or supported: false if it rejected it. This is a fast, lightweight endpoint — one handshake, one result. Useful for verifying compliance with specific security standards, checking whether a particular cipher is available on a server, answering pinning questions, and debugging TLS handshake failures. Works for both TLS 1.2 and TLS 1.3 suites.
Query Parameters (GET)
Parameter
Type
Required
Default
Description
domain
string
✅ Yes
—
Target domain or hostname.
cipher
string
✅ Yes
—
Cipher suite name to test. Must contain only letters, numbers, underscores, and hyphens.
tls_version
string
❌ No
TLSv1.2
TLS version to test on. Must match the cipher's protocol. TLSv1.2 or TLSv1.3.
