Developer docs
Everything the website checks is also available from a terminal, over a JSON API and as an MCP server for AI assistants. No sign-up is needed for normal use.
ssl.sh offers the same certificate checker through three developer interfaces:
- Command line:
curl ssl.sh/example.comprints a colored summary;/days,/chainand/jsongive script-friendly output. - JSON API:
GET /api/v1/check,chain,ct,caa,hsts,mixed-contentandPOST /api/v1/decode. - MCP server:
https://ssl.sh/mcplets Claude, Cursor and other MCP clients check certificates, search CT logs and explain SSL errors.
All three share one engine: it connects to the host, reads the certificate chain the server actually sends, verifies it against the Mozilla root store, fills in missing intermediates via AIA, and grades the result.
Reference
Command line (curl)
Run curl ssl.sh/example.com for a certificate summary, /days for days until expiry, /chain for the full chain PEM and /json for JSON. No install needed.
JSON API
REST endpoints under https://ssl.sh/api/v1/ for certificate checks, full chain PEM, CT search, CAA, HSTS, mixed content and certificate decoding.
MCP server
Connect Claude Code, Claude Desktop, Cursor or any MCP client to https://ssl.sh/mcp to check certificates, fetch chains, search CT logs and explain SSL errors.
FAQ
Do I need an API key?
No. Anonymous requests get 30 checks per minute per IP address, and identical checks within 5 minutes are served from cache without counting. An API key from the monitoring dashboard raises the limit; send it as Authorization: Bearer <key>.
Can ssl.sh check servers on my internal network?
No. The checker only connects to public IP addresses. Host names that resolve to private, loopback, link-local, CGNAT or other reserved ranges are refused with the error blocked_address.