network_ssl_certificate
Fetch and parse the live TLS certificate chain from a host:port to inspect subject, issuer, validity, expiry, SANs, fingerprints, and security analysis.
Instructions
SSL/TLS Certificate Checker. Fetches and parses the live TLS certificate chain from a host:port by opening an outbound SSL socket to it, then reports the leaf certificate's subject, issuer, validity window, expiry countdown, SANs, fingerprints, signature algorithm, public key, the presented chain, and a security analysis. Use this to inspect a server's actual served certificate (including self-signed or expired ones — peer verification is intentionally disabled, so tls_verified is always false and this is not a trust decision); use network_website_status_checker for HTTP status and response time, network_dns_lookup for DNS records, and network_whois for domain registration. Makes a real network connection to the target (hostname is pinned to a resolved public IP for SSRF safety; private, loopback, and reserved addresses are rejected), so results reflect the host's current certificate. CAPTCHA-gated and rate-limited (anonymous 5/min, 30/hour, 100/day). Key output includes days_until_expiry and expiry_status.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes | Hostname to fetch the certificate from, no scheme or path, e.g. example.com. Must resolve to a public IP. | |
| port | No | TLS port to connect to. Defaults to 443. | |
| worker_id | No | Optional registered healthy worker peer ID. Omit to use the default master-server behavior. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| success | No | True when the certificate was fetched and parsed. | |
| hostname | No | The hostname that was queried, echoed back. | |
| resolved_ip | No | The public IP the TLS socket was pinned to. | |
| port | No | The TLS port that was connected to. | |
| tls_verified | No | Always false — peer verification is intentionally disabled so invalid certs can still be inspected. Not a trust decision. | |
| timestamp | No | Server-side inspection time, Y-m-d H:i:s. | |
| certificate | No | Parsed leaf certificate fields. | |
| validation | No | Expiry and weakness checks on the leaf certificate. | |
| security_analysis | No | Heuristic grading of key exchange, cipher strength, protocol support, and certificate transparency. | |
| error | No | Present when success is false — the validation or connection failure reason. |