TLS certificate API: 5 safe checks in one request

Reference

Parameters

Name	Type	Required	Description
`domain`	string	yes	Public hostname. Scheme and path are stripped.
`full`	bool	no	Add SANs, chain, protocol details and security features. Default: false.
`format`	string	no	json or jsonp. Default: json.
`callback`	string	no	JSONP callback name. Default: callback.

Example request

curl -s "https://api2.globus.studio/v2/ssl?domain=example.com&full=1"

Open documentation

A TLS certificate API answers one question before a browser ever asks it: would this host present a valid certificate today? One request returns the expiry date, the issuer, the chain, the protocol versions the server still accepts and a quality score built from five checks.

Use it for monitoring and for a quick look at a host you do not control. The certificate is public data. Nothing in the response comes from your server.

What a TLS certificate API returns

The response is a flat object. valid says whether the current time falls between the first and last day of the certificate. days_left counts down to the expiry. issued_to and issued_by hold the common names, and certificate_type tells a domain-validated certificate from one with an organisation behind it.

{
    "success": true,
    "domain": "example.com",
    "valid": true,
    "expiration_date": "2026-12-25",
    "days_left": 52,
    "issued_to": "example.com",
    "issued_by": "...",
    "certificate_type": "DV",
    "quality": {"score": 75, "grade": "A", "label": "Very Good"},
    "protocols_supported": {"TLSv1.3": true, "TLSv1.2": true, "TLSv1.1": false, "TLSv1.0": false}
}

Add full=1 and the response also carries the subject alternative names, the full chain with the expiry of each link, the negotiated protocol and a set of security features: SHA-2 signature, forward secrecy, AEAD cipher, OCSP stapling and certificate transparency.

Expiry is the part that breaks sites

An expired certificate takes down a store, a login form and every API call that checks the chain. The failure is loud for visitors and silent for the team until someone reports it.

Set the alert on days_left, not on a fixed calendar date. Thirty days is a reasonable warning line for a renewable certificate and seven days is the point to wake someone up. A certificate that renews automatically still deserves the check: the renewal can fail quietly while the old file stays in place.

The endpoint reports an invalid certificate instead of refusing to connect, so an expired host still returns data: a monitor needs the date, not a connection error. A TLS certificate API call costs one handshake and a few hundred milliseconds, which is cheap enough for a daily check of every host you own.

Chain, protocols and the endpoints that should be off

chain_length and the chain array show whether the intermediate certificate is served. A missing intermediate works in some browsers and fails in others, and the failure looks random to the user.

protocols_supported is a four-line answer about old TLS. TLS 1.0 and TLS 1.1 have been retired by every major browser. A host that still accepts them can be talked down to a weak cipher by an old client. The TLS certificate API reports each version as a separate boolean, so the check is blunt and useful: four handshakes, one per version.

protocol inside full=1 describes the connection this request actually made: version, cipher suite, key size, whether forward secrecy and AEAD apply. PHP does not always expose the negotiated parameters for TLS 1.3. When it does not, the version comes from the highest supported protocol and key_bits is marked with key_bits_estimated: true. All TLS 1.3 suites use AEAD ciphers with at least 128-bit keys, so the estimate is safe.

Why a free certificate stops at grade A

quality in the TLS certificate API scores five things out of 100: days left, signature hash, protocol version, key size and organisation in the certificate. Domain-validated certificates, the free kind, carry no organisation. They lose those ten points and land at 75, which is the normal ceiling rather than a defect.

Treat the grade as a checklist, not as a rating of the site. A grade of A on a domain-validated certificate with 45 days left and TLS 1.3 is a healthy answer. Grade D usually means an old protocol, a short key or a certificate about to expire.

Verify a TLS certificate from the command line

The quickest manual check is the endpoint itself:

curl -s "https://api2.globus.studio/v2/ssl?domain=example.com&full=1"

For comparison, OpenSSL prints the same certificate without the scoring:

openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates -issuer

Both commands read public data. Neither needs a key or an account.

Safe automation

Only public hostnames are accepted. Private and loopback targets are blocked before any connection, which keeps the endpoint from being used to scan an internal network. The request connects to the resolved public address and times out after five to eight seconds.

The TLS certificate API sits in the heavy group with a limit of 20 requests per minute. A 429 carries Retry-After. For a monitor over a hundred hosts, spread the checks over the minute instead of firing them at once. Certificates change a few times a year, so a daily run is enough.

To find the address behind the hostname first, use the public IP address API. For the registration dates of the domain itself, see the domain age API. The WHOIS lookup covers the registry record.

Further reading: RFC 8446, TLS 1.3 and the MDN guide to TLS.