> ## Documentation Index
> Fetch the complete documentation index at: https://docs.server.express/llms.txt
> Use this file to discover all available pages before exploring further.

# Inspect a host's TLS certificate

> Does a TLS handshake and reports on the certificate: issuer, names covered, expiry, whether it matches the host, and the chain. Deliberately talks to hosts with broken certificates — that's when you need it. Names that resolve to private addresses are refused. On the Workers runtime the handshake goes through a relay, and 503 means that relay isn't available. Limited to 20 requests per minute per IP.



## OpenAPI

````yaml /api-reference/openapi.yaml get /v1/public/ssl
openapi: 3.1.0
info:
  title: Server.Express API
  version: 1.0.0
  description: >-
    The customer-facing Server.Express API: auth, billing, tickets, cloud and
    dedicated servers, hosting, reselling and account management. Every response
    uses the `{ success, data | error }` envelope.
  contact:
    name: Server.Express
    url: https://server.express
servers:
  - url: https://my.server.express/api
    description: Production
security:
  - bearerAuth: []
  - apiToken: []
tags:
  - name: API Tokens
  - name: Account
  - name: Auth
  - name: Cloud
  - name: Coupons
  - name: Credits
  - name: Dashboard
  - name: Dedicated
  - name: Health
  - name: Hosting
  - name: Integrations
  - name: Invoices
  - name: Livechat
  - name: Notifications
  - name: Passkeys
  - name: Payments
  - name: Products
  - name: Public
  - name: Public Invoices
  - name: Public Tools
  - name: Reseller
  - name: SSH Keys
  - name: Services
  - name: Tasks
  - name: Teams
  - name: Tickets
  - name: Web Hosting
  - name: Webhooks
paths:
  /v1/public/ssl:
    get:
      tags:
        - Public Tools
      summary: Inspect a host's TLS certificate
      description: >-
        Does a TLS handshake and reports on the certificate: issuer, names
        covered, expiry, whether it matches the host, and the chain.
        Deliberately talks to hosts with broken certificates — that's when you
        need it. Names that resolve to private addresses are refused. On the
        Workers runtime the handshake goes through a relay, and 503 means that
        relay isn't available. Limited to 20 requests per minute per IP.
      operationId: publicAuthSslCheck
      parameters:
        - name: host
          in: query
          required: true
          description: Domain name. IP addresses are refused.
          schema:
            type: string
        - name: port
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 65535
            default: 443
      responses:
        '200':
          description: Certificate details.
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                  - data
                properties:
                  success:
                    type: boolean
                    const: true
                  data:
                    $ref: '#/components/schemas/PublicAuthCertificateInfo'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          description: The host doesn't resolve.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '502':
          description: The host couldn't be reached, or answered without a certificate.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: >-
            The certificate checker is unavailable (Workers relay not configured
            or unreachable).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '504':
          description: The host didn't answer in time.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security: []
components:
  schemas:
    PublicAuthCertificateInfo:
      type: object
      required:
        - host
        - port
        - subject
        - issuer
        - altNames
        - validFrom
        - validTo
        - daysRemaining
        - expired
        - matchesHost
        - protocol
        - cipher
        - chain
        - selfSigned
      properties:
        host:
          type: string
        port:
          type: integer
        subject:
          type:
            - string
            - 'null'
          description: Subject CN (or O).
        issuer:
          type:
            - string
            - 'null'
          description: Issuer CN (or O).
        altNames:
          type: array
          items:
            type: string
        validFrom:
          type:
            - string
            - 'null'
        validTo:
          type:
            - string
            - 'null'
        daysRemaining:
          type:
            - integer
            - 'null'
        expired:
          type: boolean
        matchesHost:
          type: boolean
          description: >-
            Whether the certificate covers the host asked for. A wildcard covers
            exactly one label.
        protocol:
          type:
            - string
            - 'null'
          description: Negotiated TLS version, e.g. TLSv1.3.
        cipher:
          type:
            - string
            - 'null'
        chain:
          type: array
          description: Issuer chain, leaf last.
          items:
            type: string
        selfSigned:
          type: boolean
    ErrorResponse:
      type: object
      required:
        - success
        - error
      properties:
        success:
          type: boolean
          const: false
        error:
          type: string
          description: Human-readable error message.
      additionalProperties: true
  responses:
    BadRequest:
      description: Validation failed or the request is malformed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    TooManyRequests:
      description: Rate limit exceeded.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh.
        A session satisfies every API scope.
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: se_live_<prefix>_<secret>
      description: >-
        Personal API token created under Settings → API tokens. Only routes
        guarded by verifyApiAuth accept it, and the token must carry the scope
        named in the operation's x-required-scope.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.