SSL Certificate Chain

Inspect a domain's full SSL/TLS certificate chain: each certificate, expiry, issuer, TLS version, cipher and any problems.

Pay by wallet (x402) ssl-certificate-chain

Example

Input

{
  "host": "google.com"
}

Answer

{
  "host": "google.com",
  "port": 443,
  "issues": [
    "Weak key size: 256 bits"
  ],
  "authorized": true,
  "tls_version": "TLSv1.3",
  "chain_length": 3,
  "cipher_suite": "TLS_AES_256_GCM_SHA384",
  "leaf_certificate": {
    "valid_to": "2026-04-27T08:36:37.000Z",
    "san_count": 137,
    "is_expired": false,
    "valid_from": "2026-02-02T08:36:38.000Z",
    "common_name": "*.google.com",
    "organization": null,
    "days_until_expiry": 51
  },
  "certificate_chain": [
    {
      "bits": 256,
      "issuer": "C=US, O=Google Trust Services, CN=WR2",
      "subject": "CN=*.google.com",
      "valid_to": "Apr 27 08:36:37 2026 GMT",
      "valid_from": "Feb  2 08:36:38 2026 GMT",
      "serial_number": "B24FF93A9975FA670A45A4784F3ACC65",
      "subject_alt_names": [
        "DNS:*.google.com",
        "DNS:*.appengine.google.com",
        "DNS:*.bdn.dev",
        "DNS:*.origin-test.bdn.dev",
        "DNS:*.cloud.google.com",
        "DNS:*.crowdsource.google.com",
        "DNS:*.datacompute.google.com",
        "DNS:*.google.ca",
        "DNS:*.google.cl",
        "DNS:*.google.co.in",
        "DNS:*.google.co.jp",
        "DNS:*.google.co.uk",
        "DNS:*.google.com.ar",
        "DNS:*.google.com.au",
        "DNS:*.google.com.br",
        "DNS:*.google.com.co",
        "DNS:*.google.com.mx",
        "DNS:*.google.com.tr",
        "DNS:*.google.com.vn",
        "DNS:*.google.de",
        "DNS:*.google.es",
        "DNS:*.google.fr",
        "DNS:*.google.hu",
        "DNS:*.google.it",
        "DNS:*.google.nl",
        "DNS:*.google.pl",
        "DNS:*.google.pt",
        "DNS:*.googleapis.cn",
        "DNS:*.gstatic.cn",
        "DNS:*.gstatic-cn.com",
        "DNS:googlecnapps.cn",
        "DNS:*.googlecnapps.cn",
        "DNS:googleapps-cn.com",
        "DNS:*.googleapps-cn.com",
        "DNS:gkecnapps.cn",
        "DNS:*.gkecnapps.cn",
        "DNS:googledownloads.cn",
        "DNS:*.googledownloads.cn",
        "DNS:recaptcha.net.cn",
        "DNS:*.recaptcha.net.cn",
        "DNS:recaptcha-cn.net",
        "DNS:*.recaptcha-cn.net",
        "DNS:widevine.cn",
        "DNS:*.widevine.cn",
        "DNS:ampproject.org.cn",
        "DNS:*.ampproject.org.cn",
        "DNS:ampproject.net.cn",
        "DNS:*.ampproject.net.cn",
        "DNS:google-analytics-cn.com",
        "DNS:*.google-analytics-cn.com",
        "DNS:googleadservices-cn.com",
        "DNS:*.googleadservices-cn.com",
        "DNS:googlevads-cn.com",
        "DNS:*.googlevads-cn.com",
        "DNS:googleapis-cn.com",
        "DNS:*.googleapis-cn.com",
        "DNS:googleoptimize-cn.com",
        "DNS:*.googleoptimize-cn.com",
        "DNS:doubleclick-cn.net",
        "DNS:*.doubleclick-cn.net",
        "DNS:*.fls.doubleclick-cn.net",
        "DNS:*.g.doubleclick-cn.net",
        "DNS:doubleclick.cn",
        "DNS:*.doubleclick.cn",
        "DNS:*.fls.doubleclick.cn",
        "DNS:*.g.doubleclick.cn",
        "DNS:dartsearch-cn.net",
        "DNS:*.dartsearch-cn.net",
        "DNS:googletraveladservices-cn.com",
        "DNS:*.googletraveladservices-cn.com",
        "DNS:googletagservices-cn.com",
        "DNS:*.googletagservices-cn.com",
        "DNS:googletagmanager-cn.com",
        "DNS:*.googletagmanager-cn.com",
        "DNS:googlesyndication-cn.com",
        "DNS:*.googlesyndication-cn.com",
        "DNS:*.safeframe.googlesyndication-cn.com",
        "DNS:app-measurement-cn.com",
        "DNS:*.app-measurement-cn.com",
        "DNS:gvt1-cn.com",
        "DNS:*.gvt1-cn.com",
        "DNS:gvt2-cn.com",
        "DNS:*.gvt2-cn.com",
        "DNS:2mdn-cn.net",
        "DNS:*.2mdn-cn.net",
        "DNS:googleflights-cn.net",
        "DNS:*.googleflights-cn.net",
        "DNS:admob-cn.com",
        "DNS:*.admob-cn.com",
        "DNS:*.gemini.cloud.google.com",
        "DNS:googlesandbox-cn.com",
        "DNS:*.googlesandbox-cn.com",
        "DNS:*.safenup.googlesandbox-cn.com",
        "DNS:*.gstatic.com",
        "DNS:*.metric.gstatic.com",
        "DNS:*.gvt1.com",
        "DNS:*.gcpcdn.gvt1.com",
        "DNS:*.gvt2.com",
        "DNS:*.gcp.gvt2.com",
        "DNS:*.url.google.com",
        "DNS:*.youtube-nocookie.com",
        "DNS:*.ytimg.com",
        "DNS:ai.android",
        "DNS:android.com",
        "DNS:*.android.com",
        "DNS:*.flash.android.com",
        "DNS:g.cn",
        "DNS:*.g.cn",
        "DNS:g.co",
        "DNS:*.g.co",
        "DNS:goo.gl",
        "DNS:www.goo.gl",
        "DNS:google-analytics.com",
        "DNS:*.google-analytics.com",
        "DNS:google.com",
        "DNS:googlecommerce.com",
        "DNS:*.googlecommerce.com",
        "DNS:ggpht.cn",
        "DNS:*.ggpht.cn",
        "DNS:urchin.com",
        "DNS:*.urchin.com",
        "DNS:youtu.be",
        "DNS:youtube.com",
        "DNS:*.youtube.com",
        "DNS:music.youtube.com",
        "DNS:*.music.youtube.com",
        "DNS:youtubeeducation.com",
        "DNS:*.youtubeeducation.com",
        "DNS:youtubekids.com",
        "DNS:*.youtubekids.com",
        "DNS:yt.be",
        "DNS:*.yt.be",
        "DNS:android.clients.google.com",
        "DNS:*.android.google.cn",
        "DNS:*.chrome.google.cn",
        "DNS:*.developers.google.cn",
        "DNS:*.aistudio.google.com"
      ],
      "fingerprint_sha256": "B3:D4:27:15:99:07:11:68:02:2E:99:B1:A2:49:72:AA:3C:7A:B5:AA:E0:E1:F2:BF:0B:6D:81:F2:F6:81:3E:09"
    },
    {
      "bits": 2048,
      "issuer": "C=US, O=Google Trust Services LLC, CN=GTS Root R1",
      "subject": "C=US, O=Google Trust Services, CN=WR2",
      "valid_to": "Feb 20 14:00:00 2029 GMT",
      "valid_from": "Dec 13 09:00:00 2023 GMT",
      "serial_number": "7FF005A07C4CDED100AD9D66A5107B98",
      "subject_alt_names": [],
      "fingerprint_sha256": "E6:FE:22:BF:45:E4:F0:D3:B8:5C:59:E0:2C:0F:49:54:18:E1:EB:8D:32:10:F7:88:D4:8C:D5:E1:CB:54:7C:D4"
    },
    {
      "bits": 4096,
      "issuer": "C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA",
      "subject": "C=US, O=Google Trust Services LLC, CN=GTS Root R1",
      "valid_to": "Jan 28 00:00:42 2028 GMT",
      "valid_from": "Jun 19 00:00:42 2020 GMT",
      "serial_number": "77BD0D6CDB36F91AEA210FC4F058D30D",
      "subject_alt_names": [],
      "fingerprint_sha256": "3E:E0:27:8D:F7:1F:A3:C1:25:C4:CD:48:7F:01:D7:74:69:4E:6F:C5:7E:0C:D9:4C:24:EF:D7:69:13:39:18:E5"
    }
  ]
}

Inputs

Field	Type	Required	What it is
`host`	string	Yes	—
`port`	integer	No	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`issues`	array	Always (present in every successful answer)
`authorized`	boolean	Always (present in every successful answer)
`tls_version`	string	Always (present in every successful answer)
`chain_length`	integer	Always (present in every successful answer)
`leaf_certificate`	object	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "ssl-certificate-chain",
    "inputs": {
      "host": "google.com"
    },
    "max_price_cents": 5
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "ssl-certificate-chain",
    "inputs": {
      "host": "google.com"
    },
    "max_price_cents": 5
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "ssl-certificate-chain",
  inputs: {
    "host": "google.com"
  },
  max_price_cents: 5,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="ssl-certificate-chain",
    inputs={
        "host": "google.com",
    },
    max_price_cents=5,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/ssl-certificate-chain?host=google.com'

Limitations

Private certificate authorities appear untrusted
Validates chain to known root CAs — private/internal CAs will show as untrusted
What to do instead: If you use a private CA, compare the returned issuer fingerprint against your internal CA's known fingerprint

Bundled checks that include it

Website Health Check €0.40