SSL/TLS Certificates API

https://api.codepunch.com/tlscerts/v2

SSL/TLS certificate data ingested from Certificate Transparency logs. 6 to 10 million certificates processed daily, searchable across a 90-day window. Covers gTLD and ccTLD domains.

Keyword syntax: use | for OR, space for AND, double quotes for adjacent terms, and * for partial matches. Example: apple|orange finds certificates containing either word. *net finds certificates ending with net.

Search Certificates

GET /{token}/certificates

Search certificates by date and keyword. Results include subject CN, issuer, validity dates, SHA-256 thumbprint, and Subject Alternative Names.

date string optional

Date in yyyymmdd format, or one of today, yesterday, or all. Default today. Setting to all disables sorting.

kw string optional

Keyword filter applied to subject CN and SAN fields.

dts enum optional

Date source: valid_from or recorded_at. Use recorded_at for hourly ingestion pipelines to avoid fluctuation from deduplication. Use valid_from when looking for certificates activated at a specific time. Default valid_from.

dcm enum optional

Date comparison mode: eq, lt, gt, lte, gte. Default eq.

hour enum optional

Filter to a specific hour: h0 through h23 for individual hours, h24 for all. Default h24. Only applies when dcm is eq and date is not all.

dm enum optional

data or stats. Set to stats to return counts only.

{
  "status":  true,
  "date":    "2023-09-10",
  "keyword": "apple",
  "records": 2,
  "data": [
    {
      "id":               18166211,
      "subject_cn":       "apple-paybilling.com",
      "issuer_cn":        "R3",
      "valid_from":       "2023-09-27 08:57:31",
      "valid_to":         "2023-12-26 08:57:30",
      "thumprint_sha_256":"f62a6e...",
      "subject_alt_name": ["apple-paybilling.com", "www.apple-paybilling.com"]
    }
  ]
}

Recent Certificates

GET /{token}/recent

Returns the most recently issued certificates within a rolling time window. Useful for near-real-time monitoring pipelines.

timegap integer optional

Hours to look back. Default 2, maximum 168 (7 days).

kw string optional

Same keyword syntax as the certificates endpoint.

dts enum optional

valid_from or recorded_at. Default valid_from.

Certificate Detail

GET /{token}/certificate/{id}

Returns full certificate data for a given ID, including the complete x509 structure, extensions, Subject Alternative Names, and PEM-encoded certificate. The id comes from the id field in search results.