SSL Labs

Test any public HTTPS server with Qualys SSL Labs, the free TLS assessment behind ssllabs.com, and act on what it finds. Scan a host for its A+ to F grade, read the certificate chain, protocols, cipher suites and HSTS policy of every IP behind the name, and get every vulnerability test decoded into plain words rather than the result codes the API returns. Purpose-built checks answer the two questions a monitor asks: how many days the certificate has left, and whether the grade still clears the bar you set. Assessments run on Qualys's servers and are free for testing infrastructure you operate; commercial use needs their permission.

Actions

Action	What it does
Check certificate expiry	How many days a host's certificate has left, and whether that is inside the window you set.
Check scan progress	Ask how a running assessment is getting on: the status, how far through each endpoint is and how long SSL Labs thinks is left.
Check the grade	Check a host's SSL Labs grade against the lowest grade you will accept, and answer with whether it clears the bar.
Get endpoint details	The full assessment of one IP address behind a hostname: its grade, protocols, cipher suites, HSTS policy, certificate chain and every vulnerability test.
Get service status	Whether SSL Labs is up, which grading criteria it is applying and how many assessments this registration may run at once against how many are already running.
Get the last report	Read the report SSL Labs already holds for a host, without waiting.
List assessment status codes	The codes an assessment reports while it runs, with what each one means.
List root certificates	The root certificates in one of the five trust stores SSL Labs validates chains against: Mozilla, Apple macOS, Android, Java and Windows.
List vulnerabilities	Every vulnerability test SSL Labs ran on a host, endpoint by endpoint, in plain words: Heartbleed, ROBOT, POODLE, GOLDENDOODLE, Ticketbleed, DROWN, FREAK, Logjam, BEAST and the rest, each with its result and whether the server is actually vulnerable.
Register for API access	Register an email address for SSL Labs API access.
Scan a host	Assess a host's TLS configuration and wait for the result: the grade for every IP behind the hostname, the certificate chain, the protocols and cipher suites on offer and the vulnerability tests.
Start a scan	Start a fresh assessment and return straight away, without waiting for it.

Check certificate expiry

How many days a host's certificate has left, and whether that is inside the window you set. The renewal alarm: point a scheduled workflow at it and branch on 'is_expiring_soon'. Reads a stored report where there is one, so it is cheap to run daily.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.
Warn when fewer days remain thanwarn_within_daysnumber: How close to expiry counts as expiring soon. Thirty days is the usual renewal window.From 1 to 365. Default: 30.
Accept a report up to (hours) oldmax_report_age_hoursnumber: How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous.From 1 to 168. Default: 24.
Wait up to (minutes)max_wait_minutesnumber: How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'.From 1 to 15. Default: 5.

Outputs

certificate_countnumber
certificateslist
common_nameslist
days_until_expirynumber
expires_attext
from_cachetrue/false
hosttext
is_expiredtrue/false
is_expiring_soontrue/false
issuertext
pending_notetext
report_readytrue/false
report_urltext
statustext
timed_outtrue/false
warn_within_daysnumber

Example output

{
  "certificate_count": 1,
  "certificates": [
    {
      "alt_names": [
        "ssllabs.com",
        "www.ssllabs.com"
      ],
      "caa_records": [
        {
          "flags": 0,
          "tag": "issue",
          "value": "pki.goog"
        }
      ],
      "common_names": [
        "ssllabs.com"
      ],
      "crl_uris": [
        "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl"
      ],
      "days_until_expiry": 168,
      "has_issues": false,
      "has_sct": true,
      "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "is_expired": false,
      "is_revoked": false,
      "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US",
      "issues": [],
      "key_algorithm": "RSA",
      "key_size": 2048,
      "key_strength": 2048,
      "must_staple": false,
      "not_after": "2027-06-15T23:59:59Z",
      "not_before": "2026-05-20T00:00:00Z",
      "ocsp_uris": [
        "http://ocsp.digicert.com"
      ],
      "pem": null,
      "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=",
      "revocation_status": "not revoked",
      "serial_number": "0a8b2d0e1f3c4b5a6978",
      "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "signature_algorithm": "SHA256withRSA",
      "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US",
      "supports_caa": true,
      "validation_type": null
    }
  ],
  "common_names": [
    "ssllabs.com"
  ],
  "days_until_expiry": 168,
  "expires_at": "2027-06-15T23:59:59Z",
  "from_cache": true,
  "host": "www.ssllabs.com",
  "is_expired": false,
  "is_expiring_soon": false,
  "issuer": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US",
  "pending_note": null,
  "report_ready": true,
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "status": "READY",
  "timed_out": false,
  "warn_within_days": 30
}

Check scan progress

Ask how a running assessment is getting on: the status, how far through each endpoint is and how long SSL Labs thinks is left. Never starts a new assessment, so it is safe to call on a loop while one runs.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.

Outputs

best_gradetext
cache_expiry_timetext
certificate_hostnameslist
certificateslist
criteria_versiontext
endpoint_countnumber
endpoint_ipslist
endpointslist
engine_versiontext
eta_secondsnumber
failed_endpointslist
gradeslist
has_failed_endpointstrue/false
hosttext
is_completetrue/false
is_publictrue/false
is_readytrue/false
leaf_certificateslist
overall_progress_percentnumber
portnumber
protocoltext
report_urltext
start_timetext
statustext
status_messagetext
test_timetext
worst_gradetext

Example output

{
  "best_grade": "A+",
  "cache_expiry_time": null,
  "certificate_hostnames": [],
  "certificates": [],
  "criteria_version": "2009q",
  "endpoint_count": 1,
  "endpoint_ips": [
    "69.67.183.100"
  ],
  "endpoints": [
    {
      "delegation": [
        "reachable with the www prefix"
      ],
      "details": {
        "alpn_protocols": "h2 http/1.1",
        "certificate_chains": [
          {
            "certificate_ids": [
              "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a"
            ],
            "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77",
            "is_trusted": true,
            "issues": [],
            "no_sni": false
          }
        ],
        "certificate_transparency": [
          "SCT in the certificate"
        ],
        "dh_prime_count": 0,
        "drown": {
          "host_count": 0,
          "hosts": [],
          "is_vulnerable": false,
          "test_errored": false
        },
        "forward_secrecy": [
          "achieved with all simulated clients"
        ],
        "host_start_time": "2026-08-23T18:24:08Z",
        "hsts": {
          "error": null,
          "header": "max-age=31536000",
          "include_sub_domains": null,
          "is_long_enough": true,
          "is_present": true,
          "max_age_seconds": 31536000,
          "preload": null,
          "status": "present"
        },
        "hsts_preloads": [
          {
            "source": "Chrome",
            "status": "absent"
          }
        ],
        "http_forwarding": null,
        "http_status_code": 200,
        "http_transactions": [
          {
            "request_url": "https://www.ssllabs.com/",
            "status_code": 200
          }
        ],
        "implements_tls13_mandatory_suite": true,
        "insecure_suite_count": 0,
        "is_hsts_preloaded": false,
        "known_dh_primes": null,
        "misc_intolerance": [],
        "named_groups": [
          "x25519",
          "secp256r1"
        ],
        "npn_protocols": null,
        "obsolete_protocols": [],
        "ocsp_stapling": true,
        "offers_obsolete_protocols": false,
        "protocol_intolerance": [],
        "protocol_names": [
          "TLS 1.2",
          "TLS 1.3"
        ],
        "protocols": [
          {
            "id": 771,
            "is_obsolete": false,
            "label": "TLS 1.2",
            "name": "TLS",
            "version": "1.2"
          },
          {
            "id": 772,
            "is_obsolete": false,
            "label": "TLS 1.3",
            "name": "TLS",
            "version": "1.3"
          }
        ],
        "public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "renegotiation": [
          "secure renegotiation supported"
        ],
        "reuses_dh_server_value": null,
        "reuses_ecdhe_parameters": false,
        "server_signature": "nginx",
        "session_resumption": "enabled",
        "simulation": {
          "failed_count": 16,
          "failures": [
            {
              "client": "Android 2.3.7",
              "error": "Protocol mismatch (not simulated)"
            }
          ],
          "simulated_count": 68,
          "succeeded_count": 52
        },
        "sni_required": false,
        "stapled_revocation_status": null,
        "static_public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "suite_count": 17,
        "suite_groups": [
          {
            "protocol_id": 771,
            "server_has_preference": true,
            "suites": [
              {
                "cipher_strength": 128,
                "id": 49199,
                "key_exchange_strength": 3072,
                "key_exchange_type": "ECDH",
                "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
                "named_group": "x25519",
                "strength": "strong"
              }
            ]
          }
        ],
        "supports_aead": true,
        "supports_alpn": true,
        "supports_cbc": true,
        "supports_fallback_scsv": true,
        "supports_heartbeat": false,
        "supports_npn": false,
        "supports_rc4": false,
        "supports_tls12": true,
        "supports_tls13": true,
        "vulnerabilities": {
          "findings": [
            {
              "code": null,
              "is_vulnerable": false,
              "key": "heartbleed",
              "name": "Heartbleed (CVE-2014-0160)",
              "result": "not vulnerable"
            },
            {
              "code": 1,
              "is_vulnerable": false,
              "key": "bleichenbacher",
              "name": "ROBOT (Bleichenbacher oracle)",
              "result": "not vulnerable"
            }
          ],
          "is_vulnerable": false,
          "vulnerability_count": 0,
          "vulnerable_to": []
        },
        "weak_suite_count": 8,
        "zero_rtt": "not enabled"
      },
      "duration_ms": 47962,
      "eta_seconds": null,
      "future_grade": null,
      "grade": "A+",
      "grade_trust_ignored": "A+",
      "has_warnings": false,
      "ip_address": "69.67.183.100",
      "is_exceptional": true,
      "is_ready": true,
      "progress_percent": 100,
      "server_name": null,
      "status_details": null,
      "status_details_message": null,
      "status_message": "Ready"
    }
  ],
  "engine_version": "2.4.3",
  "eta_seconds": null,
  "failed_endpoints": [],
  "grades": [
    "A+"
  ],
  "has_failed_endpoints": false,
  "host": "www.ssllabs.com",
  "is_complete": false,
  "is_public": false,
  "is_ready": false,
  "leaf_certificates": [],
  "overall_progress_percent": 100,
  "port": 443,
  "protocol": "http",
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "start_time": "2026-08-23T18:24:08Z",
  "status": "IN_PROGRESS",
  "status_message": null,
  "test_time": null,
  "worst_grade": "A+"
}

Check the grade

Check a host's SSL Labs grade against the lowest grade you will accept, and answer with whether it clears the bar. The gate for a deployment check or a compliance report: it looks at every endpoint, so one badly configured server in a pool cannot hide behind the others.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.
Lowest acceptable grademinimum_gradetext: The grade every endpoint has to reach. T means the certificate is not trusted and M that it does not match the hostname; neither is a passing configuration whatever else the server scores.One of: A+ (A+ (exceptional)), A, A- (A- (has warnings)), B, C, D, E, F, T (T (certificate not trusted)), M (M (certificate name mismatch)). Default: A.
Accept a report up to (hours) oldmax_report_age_hoursnumber: How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous.From 1 to 168. Default: 24.
Wait up to (minutes)max_wait_minutesnumber: How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'.From 1 to 15. Default: 5.

Outputs

best_gradetext
endpoint_countnumber
failing_endpoint_countnumber
failing_endpointslist
from_cachetrue/false
gradeslist
hosttext
meets_minimumtrue/false
minimum_gradetext
pending_notetext
report_readytrue/false
report_urltext
statustext
timed_outtrue/false
worst_gradetext

Example output

{
  "best_grade": "A+",
  "endpoint_count": 1,
  "failing_endpoint_count": 0,
  "failing_endpoints": [],
  "from_cache": true,
  "grades": [
    "A+"
  ],
  "host": "www.ssllabs.com",
  "meets_minimum": true,
  "minimum_grade": "A",
  "pending_note": null,
  "report_ready": true,
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "status": "READY",
  "timed_out": false,
  "worst_grade": "A+"
}

Get endpoint details

The full assessment of one IP address behind a hostname: its grade, protocols, cipher suites, HSTS policy, certificate chain and every vulnerability test. A hostname on a CDN can answer from a dozen addresses with different configurations, and this reads one of them. Never starts an assessment.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.
Endpoint IP addressendpoint_iptextRequired: Which of the host's addresses to read. The addresses come from the 'endpoint_ips' list on a scan result.
Allow a stored reportfrom_cachetrue/false: Turn on to accept the stored assessment of this endpoint rather than the live one.Default: false.

Outputs

delegationlist
detailsobject
duration_msnumber
eta_secondsnumber
future_gradetext
gradetext
grade_trust_ignoredtext
has_warningstrue/false
hosttext
ip_addresstext
is_exceptionaltrue/false
is_readytrue/false
progress_percentnumber
report_urltext
server_nametext
status_detailstext
status_details_messagetext
status_messagetext

Example output

{
  "delegation": [
    "reachable with the www prefix"
  ],
  "details": {
    "alpn_protocols": "h2 http/1.1",
    "certificate_chains": [
      {
        "certificate_ids": [
          "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a"
        ],
        "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77",
        "is_trusted": true,
        "issues": [],
        "no_sni": false
      }
    ],
    "certificate_transparency": [
      "SCT in the certificate"
    ],
    "dh_prime_count": 0,
    "drown": {
      "host_count": 0,
      "hosts": [],
      "is_vulnerable": false,
      "test_errored": false
    },
    "forward_secrecy": [
      "achieved with all simulated clients"
    ],
    "host_start_time": "2026-08-23T18:24:08Z",
    "hsts": {
      "error": null,
      "header": "max-age=31536000",
      "include_sub_domains": null,
      "is_long_enough": true,
      "is_present": true,
      "max_age_seconds": 31536000,
      "preload": null,
      "status": "present"
    },
    "hsts_preloads": [
      {
        "source": "Chrome",
        "status": "absent"
      }
    ],
    "http_forwarding": null,
    "http_status_code": 200,
    "http_transactions": [
      {
        "request_url": "https://www.ssllabs.com/",
        "status_code": 200
      }
    ],
    "implements_tls13_mandatory_suite": true,
    "insecure_suite_count": 0,
    "is_hsts_preloaded": false,
    "known_dh_primes": null,
    "misc_intolerance": [],
    "named_groups": [
      "x25519",
      "secp256r1"
    ],
    "npn_protocols": null,
    "obsolete_protocols": [],
    "ocsp_stapling": true,
    "offers_obsolete_protocols": false,
    "protocol_intolerance": [],
    "protocol_names": [
      "TLS 1.2",
      "TLS 1.3"
    ],
    "protocols": [
      {
        "id": 771,
        "is_obsolete": false,
        "label": "TLS 1.2",
        "name": "TLS",
        "version": "1.2"
      },
      {
        "id": 772,
        "is_obsolete": false,
        "label": "TLS 1.3",
        "name": "TLS",
        "version": "1.3"
      }
    ],
    "public_key_pinning": {
      "error": null,
      "include_sub_domains": null,
      "max_age_seconds": null,
      "pin_count": 0,
      "report_uri": null,
      "status": "absent"
    },
    "renegotiation": [
      "secure renegotiation supported"
    ],
    "reuses_dh_server_value": null,
    "reuses_ecdhe_parameters": false,
    "server_signature": "nginx",
    "session_resumption": "enabled",
    "simulation": {
      "failed_count": 16,
      "failures": [
        {
          "client": "Android 2.3.7",
          "error": "Protocol mismatch (not simulated)"
        }
      ],
      "simulated_count": 68,
      "succeeded_count": 52
    },
    "sni_required": false,
    "stapled_revocation_status": null,
    "static_public_key_pinning": {
      "error": null,
      "include_sub_domains": null,
      "max_age_seconds": null,
      "pin_count": 0,
      "report_uri": null,
      "status": "absent"
    },
    "suite_count": 17,
    "suite_groups": [
      {
        "protocol_id": 771,
        "server_has_preference": true,
        "suites": [
          {
            "cipher_strength": 128,
            "id": 49199,
            "key_exchange_strength": 3072,
            "key_exchange_type": "ECDH",
            "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "named_group": "x25519",
            "strength": "strong"
          }
        ]
      }
    ],
    "supports_aead": true,
    "supports_alpn": true,
    "supports_cbc": true,
    "supports_fallback_scsv": true,
    "supports_heartbeat": false,
    "supports_npn": false,
    "supports_rc4": false,
    "supports_tls12": true,
    "supports_tls13": true,
    "vulnerabilities": {
      "findings": [
        {
          "code": null,
          "is_vulnerable": false,
          "key": "heartbleed",
          "name": "Heartbleed (CVE-2014-0160)",
          "result": "not vulnerable"
        },
        {
          "code": 1,
          "is_vulnerable": false,
          "key": "bleichenbacher",
          "name": "ROBOT (Bleichenbacher oracle)",
          "result": "not vulnerable"
        }
      ],
      "is_vulnerable": false,
      "vulnerability_count": 0,
      "vulnerable_to": []
    },
    "weak_suite_count": 8,
    "zero_rtt": "not enabled"
  },
  "duration_ms": 47962,
  "eta_seconds": null,
  "future_grade": null,
  "grade": "A+",
  "grade_trust_ignored": "A+",
  "has_warnings": false,
  "host": "www.ssllabs.com",
  "ip_address": "69.67.183.100",
  "is_exceptional": true,
  "is_ready": true,
  "progress_percent": 100,
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "server_name": null,
  "status_details": null,
  "status_details_message": null,
  "status_message": "Ready"
}

Get service status

Whether SSL Labs is up, which grading criteria it is applying and how many assessments this registration may run at once against how many are already running. Run it before a batch of scans to see how many will fit.

Inputs

None.

Outputs

available_assessmentsnumber
can_start_assessmenttrue/false
criteria_versiontext
current_assessmentsnumber
engine_versiontext
max_assessmentsnumber
messageslist
new_assessment_cool_off_msnumber

Example output

{
  "available_assessments": 7,
  "can_start_assessment": true,
  "criteria_version": "2009q",
  "current_assessments": 0,
  "engine_version": "2.4.3",
  "max_assessments": 7,
  "messages": [
    "This assessment service is provided free of charge by Qualys SSL Labs, subject to our terms and conditions: https://www.ssllabs.com/about/terms.html"
  ],
  "new_assessment_cool_off_ms": 1000
}

Get the last report

Read the report SSL Labs already holds for a host, without waiting. The cheapest way to read a grade. If nothing recent enough is stored, SSL Labs starts an assessment and this returns its status rather than waiting for it.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.
Accept a report up to (hours) oldmax_report_age_hoursnumber: How old the stored report may be. Leave empty to accept whatever SSL Labs holds, however old.From 1 to 168.

Outputs

assessment_startedtrue/false
best_gradetext
cache_expiry_timetext
certificate_hostnameslist
certificateslist
criteria_versiontext
endpoint_countnumber
endpoint_ipslist
endpointslist
engine_versiontext
failed_endpointslist
gradeslist
has_failed_endpointstrue/false
hosttext
is_completetrue/false
is_publictrue/false
is_readytrue/false
leaf_certificateslist
max_report_age_hoursnumber
portnumber
protocoltext
report_urltext
start_timetext
statustext
status_messagetext
test_timetext
worst_gradetext

Example output

{
  "assessment_started": false,
  "best_grade": "A+",
  "cache_expiry_time": null,
  "certificate_hostnames": [
    "ssllabs.com",
    "www.ssllabs.com"
  ],
  "certificates": [
    {
      "alt_names": [
        "ssllabs.com",
        "www.ssllabs.com"
      ],
      "caa_records": [
        {
          "flags": 0,
          "tag": "issue",
          "value": "pki.goog"
        }
      ],
      "common_names": [
        "ssllabs.com"
      ],
      "crl_uris": [
        "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl"
      ],
      "days_until_expiry": 168,
      "has_issues": false,
      "has_sct": true,
      "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "is_expired": false,
      "is_revoked": false,
      "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US",
      "issues": [],
      "key_algorithm": "RSA",
      "key_size": 2048,
      "key_strength": 2048,
      "must_staple": false,
      "not_after": "2027-06-15T23:59:59Z",
      "not_before": "2026-05-20T00:00:00Z",
      "ocsp_uris": [
        "http://ocsp.digicert.com"
      ],
      "pem": null,
      "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=",
      "revocation_status": "not revoked",
      "serial_number": "0a8b2d0e1f3c4b5a6978",
      "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "signature_algorithm": "SHA256withRSA",
      "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US",
      "supports_caa": true,
      "validation_type": null
    }
  ],
  "criteria_version": "2009q",
  "endpoint_count": 1,
  "endpoint_ips": [
    "69.67.183.100"
  ],
  "endpoints": [
    {
      "delegation": [
        "reachable with the www prefix"
      ],
      "details": {
        "alpn_protocols": "h2 http/1.1",
        "certificate_chains": [
          {
            "certificate_ids": [
              "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a"
            ],
            "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77",
            "is_trusted": true,
            "issues": [],
            "no_sni": false
          }
        ],
        "certificate_transparency": [
          "SCT in the certificate"
        ],
        "dh_prime_count": 0,
        "drown": {
          "host_count": 0,
          "hosts": [],
          "is_vulnerable": false,
          "test_errored": false
        },
        "forward_secrecy": [
          "achieved with all simulated clients"
        ],
        "host_start_time": "2026-08-23T18:24:08Z",
        "hsts": {
          "error": null,
          "header": "max-age=31536000",
          "include_sub_domains": null,
          "is_long_enough": true,
          "is_present": true,
          "max_age_seconds": 31536000,
          "preload": null,
          "status": "present"
        },
        "hsts_preloads": [
          {
            "source": "Chrome",
            "status": "absent"
          }
        ],
        "http_forwarding": null,
        "http_status_code": 200,
        "http_transactions": [
          {
            "request_url": "https://www.ssllabs.com/",
            "status_code": 200
          }
        ],
        "implements_tls13_mandatory_suite": true,
        "insecure_suite_count": 0,
        "is_hsts_preloaded": false,
        "known_dh_primes": null,
        "misc_intolerance": [],
        "named_groups": [
          "x25519",
          "secp256r1"
        ],
        "npn_protocols": null,
        "obsolete_protocols": [],
        "ocsp_stapling": true,
        "offers_obsolete_protocols": false,
        "protocol_intolerance": [],
        "protocol_names": [
          "TLS 1.2",
          "TLS 1.3"
        ],
        "protocols": [
          {
            "id": 771,
            "is_obsolete": false,
            "label": "TLS 1.2",
            "name": "TLS",
            "version": "1.2"
          },
          {
            "id": 772,
            "is_obsolete": false,
            "label": "TLS 1.3",
            "name": "TLS",
            "version": "1.3"
          }
        ],
        "public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "renegotiation": [
          "secure renegotiation supported"
        ],
        "reuses_dh_server_value": null,
        "reuses_ecdhe_parameters": false,
        "server_signature": "nginx",
        "session_resumption": "enabled",
        "simulation": {
          "failed_count": 16,
          "failures": [
            {
              "client": "Android 2.3.7",
              "error": "Protocol mismatch (not simulated)"
            }
          ],
          "simulated_count": 68,
          "succeeded_count": 52
        },
        "sni_required": false,
        "stapled_revocation_status": null,
        "static_public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "suite_count": 17,
        "suite_groups": [
          {
            "protocol_id": 771,
            "server_has_preference": true,
            "suites": [
              {
                "cipher_strength": 128,
                "id": 49199,
                "key_exchange_strength": 3072,
                "key_exchange_type": "ECDH",
                "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
                "named_group": "x25519",
                "strength": "strong"
              }
            ]
          }
        ],
        "supports_aead": true,
        "supports_alpn": true,
        "supports_cbc": true,
        "supports_fallback_scsv": true,
        "supports_heartbeat": false,
        "supports_npn": false,
        "supports_rc4": false,
        "supports_tls12": true,
        "supports_tls13": true,
        "vulnerabilities": {
          "findings": [
            {
              "code": null,
              "is_vulnerable": false,
              "key": "heartbleed",
              "name": "Heartbleed (CVE-2014-0160)",
              "result": "not vulnerable"
            },
            {
              "code": 1,
              "is_vulnerable": false,
              "key": "bleichenbacher",
              "name": "ROBOT (Bleichenbacher oracle)",
              "result": "not vulnerable"
            }
          ],
          "is_vulnerable": false,
          "vulnerability_count": 0,
          "vulnerable_to": []
        },
        "weak_suite_count": 8,
        "zero_rtt": "not enabled"
      },
      "duration_ms": 47962,
      "eta_seconds": null,
      "future_grade": null,
      "grade": "A+",
      "grade_trust_ignored": "A+",
      "has_warnings": false,
      "ip_address": "69.67.183.100",
      "is_exceptional": true,
      "is_ready": true,
      "progress_percent": 100,
      "server_name": null,
      "status_details": null,
      "status_details_message": null,
      "status_message": "Ready"
    }
  ],
  "engine_version": "2.4.3",
  "failed_endpoints": [],
  "grades": [
    "A+"
  ],
  "has_failed_endpoints": false,
  "host": "www.ssllabs.com",
  "is_complete": true,
  "is_public": false,
  "is_ready": true,
  "leaf_certificates": [
    {
      "alt_names": [
        "ssllabs.com",
        "www.ssllabs.com"
      ],
      "caa_records": [
        {
          "flags": 0,
          "tag": "issue",
          "value": "pki.goog"
        }
      ],
      "common_names": [
        "ssllabs.com"
      ],
      "crl_uris": [
        "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl"
      ],
      "days_until_expiry": 168,
      "has_issues": false,
      "has_sct": true,
      "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "is_expired": false,
      "is_revoked": false,
      "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US",
      "issues": [],
      "key_algorithm": "RSA",
      "key_size": 2048,
      "key_strength": 2048,
      "must_staple": false,
      "not_after": "2027-06-15T23:59:59Z",
      "not_before": "2026-05-20T00:00:00Z",
      "ocsp_uris": [
        "http://ocsp.digicert.com"
      ],
      "pem": null,
      "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=",
      "revocation_status": "not revoked",
      "serial_number": "0a8b2d0e1f3c4b5a6978",
      "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "signature_algorithm": "SHA256withRSA",
      "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US",
      "supports_caa": true,
      "validation_type": null
    }
  ],
  "max_report_age_hours": 24,
  "port": 443,
  "protocol": "http",
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "start_time": "2026-08-23T18:24:08Z",
  "status": "READY",
  "status_message": null,
  "test_time": "2026-08-23T18:24:57Z",
  "worst_grade": "A+"
}

List assessment status codes

The codes an assessment reports while it runs, with what each one means. 'Check scan progress' returns a code such as TESTING_HEARTBLEED, and this is the table that turns it into 'Testing Heartbleed'.

Inputs

None.

Outputs

codeslist
status_code_countnumber
status_codeslist

Example output

{
  "codes": [
    "TESTING_HEARTBLEED",
    "PREPARING_REPORT"
  ],
  "status_code_count": 2,
  "status_codes": [
    {
      "code": "TESTING_HEARTBLEED",
      "message": "Testing Heartbleed"
    },
    {
      "code": "PREPARING_REPORT",
      "message": "Preparing the report"
    }
  ]
}

List root certificates

The root certificates in one of the five trust stores SSL Labs validates chains against: Mozilla, Apple macOS, Android, Java and Windows. Each root comes back with its name, subject, key and validity dates, and the days it has left, so you can see which roots are about to age out. The PEM itself is left out unless you ask for it.

Inputs

Trust storetrust_storetext: Whose list of trusted roots to read.One of: 1 (Mozilla), 2 (Apple macOS), 3 (Android), 4 (Java), 5 (Windows). Default: 1.
Searchsearchtext: Return only the roots whose name or subject contains this text, for example 'DigiCert' or 'ISRG'. Leave empty for all of them.
Include the PEM certificateinclude_pemtrue/false: Turn on to include each root's PEM text. Off by default: a whole trust store runs to about a megabyte of it.Default: false.
Maximum roots to returnlimitnumber: How many matching roots to return. The largest store holds a little over five hundred.From 1 to 1000. Default: 100.

Outputs

certificate_countnumber
certificateslist
includes_pemtrue/false
matched_countnumber
searchtext
total_countnumber
trust_storetext
trust_store_nametext
trust_store_versiontext

Example output

{
  "certificate_count": 1,
  "certificates": [
    {
      "days_until_expiry": 3207,
      "is_expired": false,
      "key_algorithm": "RSA",
      "key_size": 4096,
      "name": "ISRG Root X1",
      "not_after": "2035-06-04T11:04:38Z",
      "not_before": "2015-06-04T11:04:38Z",
      "pem": null,
      "subject": "CN=ISRG Root X1, O=Internet Security Research Group, C=US"
    }
  ],
  "includes_pem": false,
  "matched_count": 1,
  "search": "ISRG",
  "total_count": 150,
  "trust_store": "1",
  "trust_store_name": "Mozilla",
  "trust_store_version": "Mozilla(Mozilla)"
}

List vulnerabilities

Every vulnerability test SSL Labs ran on a host, endpoint by endpoint, in plain words: Heartbleed, ROBOT, POODLE, GOLDENDOODLE, Ticketbleed, DROWN, FREAK, Logjam, BEAST and the rest, each with its result and whether the server is actually vulnerable. Also reports obsolete protocols and how many weak or insecure cipher suites are on offer.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.
Accept a report up to (hours) oldmax_report_age_hoursnumber: How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous.From 1 to 168. Default: 24.
Wait up to (minutes)max_wait_minutesnumber: How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'.From 1 to 15. Default: 5.

Outputs

endpoint_countnumber
endpointslist
from_cachetrue/false
hosttext
is_vulnerabletrue/false
pending_notetext
report_readytrue/false
report_urltext
statustext
timed_outtrue/false
vulnerability_countnumber
vulnerable_tolist

Example output

{
  "endpoint_count": 1,
  "endpoints": [
    {
      "findings": [
        {
          "code": null,
          "is_vulnerable": false,
          "key": "heartbleed",
          "name": "Heartbleed (CVE-2014-0160)",
          "result": "not vulnerable"
        }
      ],
      "grade": "A+",
      "insecure_suite_count": 0,
      "ip_address": "69.67.183.100",
      "is_vulnerable": false,
      "obsolete_protocols": [],
      "vulnerable_to": [],
      "weak_suite_count": 8
    }
  ],
  "from_cache": true,
  "host": "www.ssllabs.com",
  "is_vulnerable": false,
  "pending_note": null,
  "report_ready": true,
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "status": "READY",
  "timed_out": false,
  "vulnerability_count": 0,
  "vulnerable_to": []
}

Register for API access

Register an email address for SSL Labs API access. Connecting this integration already registers the address you connected with, so this is for registering a second one. SSL Labs does not accept free mail domains such as Gmail, Yahoo or Hotmail: the address has to be an organization one.

Inputs

First namefirst_nametextRequired: The first name to register.
Last namelast_nametextRequired: The last name to register.
OrganizationorganizationtextRequired: The organization the address belongs to.
Email addressemailtext: The work address to register. Leave empty to register the address this integration is connected with.

Outputs

emailtext
is_registeredtrue/false
messagetext
statustext
was_already_registeredtrue/false

Example output

{
  "email": "you@yourcompany.com",
  "is_registered": true,
  "message": "User successfully registered",
  "status": "success",
  "was_already_registered": false
}

Scan a host

Assess a host's TLS configuration and wait for the result: the grade for every IP behind the hostname, the certificate chain, the protocols and cipher suites on offer and the vulnerability tests. Uses a stored report when there is a recent one and runs a fresh assessment otherwise, so a scheduled check is cheap to repeat.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.
Use a stored report when there is oneuse_cached_reporttrue/false: On by default: a report younger than the age below is returned straight away. Turn off to always run a fresh assessment, which takes a few minutes and counts against the assessment limit.Default: true.
Accept a report up to (hours) oldmax_report_age_hoursnumber: How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous.From 1 to 168. Default: 24.
Wait up to (minutes)max_wait_minutesnumber: How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'.From 1 to 15. Default: 5.
Publish the result publiclypublishtrue/false: Turn on to list the result on the public SSL Labs boards at ssllabs.com. Off by default: results stay unlisted.Default: false.
Assess even if the certificate name does not matchignore_certificate_mismatchtrue/false: Turn on to carry on assessing a server whose certificate is issued for a different hostname. Off by default, when SSL Labs stops and reports the mismatch instead.Default: false.

Outputs

best_gradetext
cache_expiry_timetext
certificate_hostnameslist
certificateslist
criteria_versiontext
endpoint_countnumber
endpoint_ipslist
endpointslist
engine_versiontext
failed_endpointslist
from_cachetrue/false
gradeslist
has_failed_endpointstrue/false
hosttext
is_completetrue/false
is_publictrue/false
is_readytrue/false
leaf_certificateslist
pending_notetext
poll_countnumber
portnumber
protocoltext
report_urltext
start_timetext
statustext
status_messagetext
test_timetext
timed_outtrue/false
waited_secondsnumber
worst_gradetext

Example output

{
  "best_grade": "A+",
  "cache_expiry_time": null,
  "certificate_hostnames": [
    "ssllabs.com",
    "www.ssllabs.com"
  ],
  "certificates": [
    {
      "alt_names": [
        "ssllabs.com",
        "www.ssllabs.com"
      ],
      "caa_records": [
        {
          "flags": 0,
          "tag": "issue",
          "value": "pki.goog"
        }
      ],
      "common_names": [
        "ssllabs.com"
      ],
      "crl_uris": [
        "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl"
      ],
      "days_until_expiry": 168,
      "has_issues": false,
      "has_sct": true,
      "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "is_expired": false,
      "is_revoked": false,
      "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US",
      "issues": [],
      "key_algorithm": "RSA",
      "key_size": 2048,
      "key_strength": 2048,
      "must_staple": false,
      "not_after": "2027-06-15T23:59:59Z",
      "not_before": "2026-05-20T00:00:00Z",
      "ocsp_uris": [
        "http://ocsp.digicert.com"
      ],
      "pem": null,
      "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=",
      "revocation_status": "not revoked",
      "serial_number": "0a8b2d0e1f3c4b5a6978",
      "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "signature_algorithm": "SHA256withRSA",
      "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US",
      "supports_caa": true,
      "validation_type": null
    }
  ],
  "criteria_version": "2009q",
  "endpoint_count": 1,
  "endpoint_ips": [
    "69.67.183.100"
  ],
  "endpoints": [
    {
      "delegation": [
        "reachable with the www prefix"
      ],
      "details": {
        "alpn_protocols": "h2 http/1.1",
        "certificate_chains": [
          {
            "certificate_ids": [
              "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a"
            ],
            "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77",
            "is_trusted": true,
            "issues": [],
            "no_sni": false
          }
        ],
        "certificate_transparency": [
          "SCT in the certificate"
        ],
        "dh_prime_count": 0,
        "drown": {
          "host_count": 0,
          "hosts": [],
          "is_vulnerable": false,
          "test_errored": false
        },
        "forward_secrecy": [
          "achieved with all simulated clients"
        ],
        "host_start_time": "2026-08-23T18:24:08Z",
        "hsts": {
          "error": null,
          "header": "max-age=31536000",
          "include_sub_domains": null,
          "is_long_enough": true,
          "is_present": true,
          "max_age_seconds": 31536000,
          "preload": null,
          "status": "present"
        },
        "hsts_preloads": [
          {
            "source": "Chrome",
            "status": "absent"
          }
        ],
        "http_forwarding": null,
        "http_status_code": 200,
        "http_transactions": [
          {
            "request_url": "https://www.ssllabs.com/",
            "status_code": 200
          }
        ],
        "implements_tls13_mandatory_suite": true,
        "insecure_suite_count": 0,
        "is_hsts_preloaded": false,
        "known_dh_primes": null,
        "misc_intolerance": [],
        "named_groups": [
          "x25519",
          "secp256r1"
        ],
        "npn_protocols": null,
        "obsolete_protocols": [],
        "ocsp_stapling": true,
        "offers_obsolete_protocols": false,
        "protocol_intolerance": [],
        "protocol_names": [
          "TLS 1.2",
          "TLS 1.3"
        ],
        "protocols": [
          {
            "id": 771,
            "is_obsolete": false,
            "label": "TLS 1.2",
            "name": "TLS",
            "version": "1.2"
          },
          {
            "id": 772,
            "is_obsolete": false,
            "label": "TLS 1.3",
            "name": "TLS",
            "version": "1.3"
          }
        ],
        "public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "renegotiation": [
          "secure renegotiation supported"
        ],
        "reuses_dh_server_value": null,
        "reuses_ecdhe_parameters": false,
        "server_signature": "nginx",
        "session_resumption": "enabled",
        "simulation": {
          "failed_count": 16,
          "failures": [
            {
              "client": "Android 2.3.7",
              "error": "Protocol mismatch (not simulated)"
            }
          ],
          "simulated_count": 68,
          "succeeded_count": 52
        },
        "sni_required": false,
        "stapled_revocation_status": null,
        "static_public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "suite_count": 17,
        "suite_groups": [
          {
            "protocol_id": 771,
            "server_has_preference": true,
            "suites": [
              {
                "cipher_strength": 128,
                "id": 49199,
                "key_exchange_strength": 3072,
                "key_exchange_type": "ECDH",
                "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
                "named_group": "x25519",
                "strength": "strong"
              }
            ]
          }
        ],
        "supports_aead": true,
        "supports_alpn": true,
        "supports_cbc": true,
        "supports_fallback_scsv": true,
        "supports_heartbeat": false,
        "supports_npn": false,
        "supports_rc4": false,
        "supports_tls12": true,
        "supports_tls13": true,
        "vulnerabilities": {
          "findings": [
            {
              "code": null,
              "is_vulnerable": false,
              "key": "heartbleed",
              "name": "Heartbleed (CVE-2014-0160)",
              "result": "not vulnerable"
            },
            {
              "code": 1,
              "is_vulnerable": false,
              "key": "bleichenbacher",
              "name": "ROBOT (Bleichenbacher oracle)",
              "result": "not vulnerable"
            }
          ],
          "is_vulnerable": false,
          "vulnerability_count": 0,
          "vulnerable_to": []
        },
        "weak_suite_count": 8,
        "zero_rtt": "not enabled"
      },
      "duration_ms": 47962,
      "eta_seconds": null,
      "future_grade": null,
      "grade": "A+",
      "grade_trust_ignored": "A+",
      "has_warnings": false,
      "ip_address": "69.67.183.100",
      "is_exceptional": true,
      "is_ready": true,
      "progress_percent": 100,
      "server_name": null,
      "status_details": null,
      "status_details_message": null,
      "status_message": "Ready"
    }
  ],
  "engine_version": "2.4.3",
  "failed_endpoints": [],
  "from_cache": true,
  "grades": [
    "A+"
  ],
  "has_failed_endpoints": false,
  "host": "www.ssllabs.com",
  "is_complete": true,
  "is_public": false,
  "is_ready": true,
  "leaf_certificates": [
    {
      "alt_names": [
        "ssllabs.com",
        "www.ssllabs.com"
      ],
      "caa_records": [
        {
          "flags": 0,
          "tag": "issue",
          "value": "pki.goog"
        }
      ],
      "common_names": [
        "ssllabs.com"
      ],
      "crl_uris": [
        "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl"
      ],
      "days_until_expiry": 168,
      "has_issues": false,
      "has_sct": true,
      "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "is_expired": false,
      "is_revoked": false,
      "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US",
      "issues": [],
      "key_algorithm": "RSA",
      "key_size": 2048,
      "key_strength": 2048,
      "must_staple": false,
      "not_after": "2027-06-15T23:59:59Z",
      "not_before": "2026-05-20T00:00:00Z",
      "ocsp_uris": [
        "http://ocsp.digicert.com"
      ],
      "pem": null,
      "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=",
      "revocation_status": "not revoked",
      "serial_number": "0a8b2d0e1f3c4b5a6978",
      "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a",
      "signature_algorithm": "SHA256withRSA",
      "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US",
      "supports_caa": true,
      "validation_type": null
    }
  ],
  "pending_note": null,
  "poll_count": 0,
  "port": 443,
  "protocol": "http",
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "start_time": "2026-08-23T18:24:08Z",
  "status": "READY",
  "status_message": null,
  "test_time": "2026-08-23T18:24:57Z",
  "timed_out": false,
  "waited_seconds": 0,
  "worst_grade": "A+"
}

Start a scan

Start a fresh assessment and return straight away, without waiting for it. For a host that takes longer to assess than a step should sit and wait: start it here, then read the result later with 'Check scan progress' or 'Get the last report'.

Inputs

HostnamehosttextRequired: The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname.
Publish the result publiclypublishtrue/false: Turn on to list the result on the public SSL Labs boards at ssllabs.com. Off by default: results stay unlisted.Default: false.
Assess even if the certificate name does not matchignore_certificate_mismatchtrue/false: Turn on to carry on assessing a server whose certificate is issued for a different hostname. Off by default, when SSL Labs stops and reports the mismatch instead.Default: false.

Outputs

best_gradetext
cache_expiry_timetext
certificate_hostnameslist
certificateslist
criteria_versiontext
endpoint_countnumber
endpoint_ipslist
endpointslist
engine_versiontext
failed_endpointslist
gradeslist
has_failed_endpointstrue/false
hosttext
is_completetrue/false
is_publictrue/false
is_readytrue/false
leaf_certificateslist
portnumber
protocoltext
report_urltext
start_timetext
startedtrue/false
statustext
status_messagetext
test_timetext
worst_gradetext

Example output

{
  "best_grade": null,
  "cache_expiry_time": null,
  "certificate_hostnames": [],
  "certificates": [],
  "criteria_version": "2009q",
  "endpoint_count": 1,
  "endpoint_ips": [
    "69.67.183.100"
  ],
  "endpoints": [
    {
      "delegation": [
        "reachable with the www prefix"
      ],
      "details": {
        "alpn_protocols": "h2 http/1.1",
        "certificate_chains": [
          {
            "certificate_ids": [
              "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a"
            ],
            "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77",
            "is_trusted": true,
            "issues": [],
            "no_sni": false
          }
        ],
        "certificate_transparency": [
          "SCT in the certificate"
        ],
        "dh_prime_count": 0,
        "drown": {
          "host_count": 0,
          "hosts": [],
          "is_vulnerable": false,
          "test_errored": false
        },
        "forward_secrecy": [
          "achieved with all simulated clients"
        ],
        "host_start_time": "2026-08-23T18:24:08Z",
        "hsts": {
          "error": null,
          "header": "max-age=31536000",
          "include_sub_domains": null,
          "is_long_enough": true,
          "is_present": true,
          "max_age_seconds": 31536000,
          "preload": null,
          "status": "present"
        },
        "hsts_preloads": [
          {
            "source": "Chrome",
            "status": "absent"
          }
        ],
        "http_forwarding": null,
        "http_status_code": 200,
        "http_transactions": [
          {
            "request_url": "https://www.ssllabs.com/",
            "status_code": 200
          }
        ],
        "implements_tls13_mandatory_suite": true,
        "insecure_suite_count": 0,
        "is_hsts_preloaded": false,
        "known_dh_primes": null,
        "misc_intolerance": [],
        "named_groups": [
          "x25519",
          "secp256r1"
        ],
        "npn_protocols": null,
        "obsolete_protocols": [],
        "ocsp_stapling": true,
        "offers_obsolete_protocols": false,
        "protocol_intolerance": [],
        "protocol_names": [
          "TLS 1.2",
          "TLS 1.3"
        ],
        "protocols": [
          {
            "id": 771,
            "is_obsolete": false,
            "label": "TLS 1.2",
            "name": "TLS",
            "version": "1.2"
          },
          {
            "id": 772,
            "is_obsolete": false,
            "label": "TLS 1.3",
            "name": "TLS",
            "version": "1.3"
          }
        ],
        "public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "renegotiation": [
          "secure renegotiation supported"
        ],
        "reuses_dh_server_value": null,
        "reuses_ecdhe_parameters": false,
        "server_signature": "nginx",
        "session_resumption": "enabled",
        "simulation": {
          "failed_count": 16,
          "failures": [
            {
              "client": "Android 2.3.7",
              "error": "Protocol mismatch (not simulated)"
            }
          ],
          "simulated_count": 68,
          "succeeded_count": 52
        },
        "sni_required": false,
        "stapled_revocation_status": null,
        "static_public_key_pinning": {
          "error": null,
          "include_sub_domains": null,
          "max_age_seconds": null,
          "pin_count": 0,
          "report_uri": null,
          "status": "absent"
        },
        "suite_count": 17,
        "suite_groups": [
          {
            "protocol_id": 771,
            "server_has_preference": true,
            "suites": [
              {
                "cipher_strength": 128,
                "id": 49199,
                "key_exchange_strength": 3072,
                "key_exchange_type": "ECDH",
                "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
                "named_group": "x25519",
                "strength": "strong"
              }
            ]
          }
        ],
        "supports_aead": true,
        "supports_alpn": true,
        "supports_cbc": true,
        "supports_fallback_scsv": true,
        "supports_heartbeat": false,
        "supports_npn": false,
        "supports_rc4": false,
        "supports_tls12": true,
        "supports_tls13": true,
        "vulnerabilities": {
          "findings": [
            {
              "code": null,
              "is_vulnerable": false,
              "key": "heartbleed",
              "name": "Heartbleed (CVE-2014-0160)",
              "result": "not vulnerable"
            },
            {
              "code": 1,
              "is_vulnerable": false,
              "key": "bleichenbacher",
              "name": "ROBOT (Bleichenbacher oracle)",
              "result": "not vulnerable"
            }
          ],
          "is_vulnerable": false,
          "vulnerability_count": 0,
          "vulnerable_to": []
        },
        "weak_suite_count": 8,
        "zero_rtt": "not enabled"
      },
      "duration_ms": 47962,
      "eta_seconds": null,
      "future_grade": null,
      "grade": "A+",
      "grade_trust_ignored": "A+",
      "has_warnings": false,
      "ip_address": "69.67.183.100",
      "is_exceptional": true,
      "is_ready": true,
      "progress_percent": 100,
      "server_name": null,
      "status_details": null,
      "status_details_message": null,
      "status_message": "Ready"
    }
  ],
  "engine_version": "2.4.3",
  "failed_endpoints": [],
  "grades": [],
  "has_failed_endpoints": false,
  "host": "www.ssllabs.com",
  "is_complete": false,
  "is_public": false,
  "is_ready": false,
  "leaf_certificates": [],
  "port": 443,
  "protocol": "http",
  "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com",
  "start_time": "2026-08-23T18:24:08Z",
  "started": true,
  "status": "IN_PROGRESS",
  "status_message": null,
  "test_time": null,
  "worst_grade": null
}

ActionsCopy Anchor Link

Check certificate expiryCopy Anchor Link

Inputs

Outputs

Check scan progressCopy Anchor Link

Inputs

Outputs

Check the gradeCopy Anchor Link

Inputs

Outputs

Get endpoint detailsCopy Anchor Link

Inputs

Outputs

Get service statusCopy Anchor Link

Inputs

Outputs

Get the last reportCopy Anchor Link

Inputs

Outputs

List assessment status codesCopy Anchor Link

Inputs

Outputs

List root certificatesCopy Anchor Link

Inputs

Outputs

List vulnerabilitiesCopy Anchor Link

Inputs

Outputs

Register for API accessCopy Anchor Link

Inputs

Outputs

Scan a hostCopy Anchor Link

Inputs

Outputs

Start a scanCopy Anchor Link

Inputs

Outputs

On this page

Actions

Check certificate expiry

Check scan progress

Check the grade

Get endpoint details

Get service status

Get the last report

List assessment status codes

List root certificates

List vulnerabilities

Register for API access

Scan a host

Start a scan