ForHosting KIT · Web Scraping & Monitoring

Check an SSL certificate

Certificates don't fail loudly until the moment a browser slaps a red warning on your checkout page. This endpoint inspects a domain's TLS certificate — issuer, validity window, chain and days remaining — so expiry becomes a scheduled non-event instead of a Monday-morning emergency.

● StablePer request + per domain$0.002

Run — $0.002 How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Run it online

Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.

The expiry that always catches someone off guard

Certificate authorities moved from multi-year certs to 90-day and shorter lifetimes years ago precisely to force automation, yet plenty of teams still renew by hand once a year and forget. The result is predictable: a certificate quietly expires, browsers start throwing interstitial warnings, and support tickets pile up before anyone notices. An automated checker turns that surprise into a line item on a calendar.

What the check actually inspects

POST /web/ssl-check with a hostname (and optional port) and the task connects to the server's TLS endpoint to read back the presented certificate: issuer common name, subject, validity dates, days until expiry, and the full chain up to the root so you can catch a missing intermediate — a classic cause of 'works on my machine, breaks on mobile' bugs. The task runs async and delivers its result by webhook or a 24-hour signed link.

Not just expiry — chain problems too

A surprising share of SSL incidents aren't expired certs at all; they're incomplete chains where the leaf certificate is valid but the intermediate isn't served, so some clients trust it and others reject it silently. Because this endpoint returns the full chain rather than a single pass/fail flag, you can catch that class of bug before customers on older devices start seeing errors you can't reproduce on your own laptop.

Where it plugs into your stack

Hook it into a nightly cron across your whole domain portfolio, call it from a deploy pipeline right after a certificate renewal to confirm the new cert actually took effect, or wire it into an internal dashboard that lists every property your company runs with its days-to-expiry sorted ascending. It's a building block, not a dashboard itself — you decide the shape it takes.

Straightforward pricing, no surprise renewal panic

Each check costs $0.002, cheap enough to run daily against your entire domain list without a second thought. If a check can't complete because of an issue on our end, it's retried automatically up to three times and never billed — you only pay for checks that actually complete, whether the certificate turns out healthy or not.

What you can do with it

Portfolio-wide renewal calendar

A hosting reseller runs a nightly check across every client domain and builds an internal calendar sorted by days-to-expiry.

Post-renewal verification

After an automated cert renewal job runs, a deploy pipeline calls this endpoint to confirm the live server is actually presenting the new certificate.

Chain completeness audit

A security team scans its subdomains to find leaf certificates missing an intermediate before mobile users start reporting broken connections.

Vendor and partner monitoring

A company checks the certificates of third-party APIs it depends on, so an upstream partner's expiring cert doesn't take down its own integration unannounced.

FAQ

What exactly does the SSL checker API return?

Issuer, subject, validity dates, days remaining until expiry, and the full certificate chain up to the root for the hostname you submit.

Can it detect an incomplete certificate chain?

Yes. Because the full chain is returned rather than a single valid/invalid flag, you can spot a missing intermediate certificate, a common cause of device-specific trust errors.

Is there a free way to try this?

There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.

How fast until I get results?

The check runs asynchronously and typically completes quickly; you're notified via signed webhook or can fetch the result from a signed link valid for 24 hours.

Does it check non-standard ports?

Yes, you can specify the port along with the hostname, useful for services running TLS on something other than 443.

Do I get charged if the certificate is already expired?

Yes, that's a successful, informative result and is billed normally. You're only not charged if our task itself fails to execute, which is retried up to three times automatically.

Can I monitor an entire list of domains in bulk?

You call the endpoint once per hostname, but nothing stops you from scripting it across a full domain list on a schedule; at $0.002 per check that's affordable at scale.

Is this the same as a browser padlock check?

It goes further: a browser only tells you trusted or not; this returns the underlying issuer, dates and chain data so you can diagnose why, not just whether.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/web/ssl-check

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/web/ssl-check \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"domain":"ejemplo.com"}'

const res = await fetch("https://api.kit.forhosting.com/web/ssl-check", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "domain": "ejemplo.com"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/web/ssl-check",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "domain": "ejemplo.com"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/web/ssl-check", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"domain":"ejemplo.com"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"domain":"ejemplo.com"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/web/ssl-check", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "domain": "ejemplo.com"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "web.ssl_check",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Limits

`timeout_sec`	30
`max_crawl_pages`	25

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →