# SSL Labs > Test any public HTTPS server with Qualys SSL Labs, the free TLS assessment behind ssllabs.com, and act on what it finds. Scan a host for its A+ to F grade, read the certificate chain, protocols, cipher suites and HSTS policy of every IP behind the name, and get every vulnerability test decoded into plain words rather than the result codes the API returns. Purpose-built checks answer the two questions a monitor asks: how many days the certificate has left, and whether the grade still clears the bar you set. Assessments run on Qualys's servers and are free for testing infrastructure you operate; commercial use needs their permission. App · Compliance & Security · 12 actions. Web page: https://docs.lodol.com/docs/integrations/ssl-labs ## Actions ### Check certificate expiry How many days a host's certificate has left, and whether that is inside the window you set. The renewal alarm: point a scheduled workflow at it and branch on 'is_expiring_soon'. Reads a stored report where there is one, so it is cheap to run daily. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. - Warn when fewer days remain than (`warn_within_days`, number): How close to expiry counts as expiring soon. Thirty days is the usual renewal window. From 1 to 365. Default: `30`. - Accept a report up to (hours) old (`max_report_age_hours`, number): How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous. From 1 to 168. Default: `24`. - Wait up to (minutes) (`max_wait_minutes`, number): How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'. From 1 to 15. Default: `5`. **Outputs** - `certificate_count` (number) - `certificates` (list) - `common_names` (list) - `days_until_expiry` (number) - `expires_at` (text) - `from_cache` (true/false) - `host` (text) - `is_expired` (true/false) - `is_expiring_soon` (true/false) - `issuer` (text) - `pending_note` (text) - `report_ready` (true/false) - `report_url` (text) - `status` (text) - `timed_out` (true/false) - `warn_within_days` (number) **Example output** ```json { "certificate_count": 1, "certificates": [ { "alt_names": [ "ssllabs.com", "www.ssllabs.com" ], "caa_records": [ { "flags": 0, "tag": "issue", "value": "pki.goog" } ], "common_names": [ "ssllabs.com" ], "crl_uris": [ "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl" ], "days_until_expiry": 168, "has_issues": false, "has_sct": true, "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "is_expired": false, "is_revoked": false, "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US", "issues": [], "key_algorithm": "RSA", "key_size": 2048, "key_strength": 2048, "must_staple": false, "not_after": "2027-06-15T23:59:59Z", "not_before": "2026-05-20T00:00:00Z", "ocsp_uris": [ "http://ocsp.digicert.com" ], "pem": null, "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=", "revocation_status": "not revoked", "serial_number": "0a8b2d0e1f3c4b5a6978", "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "signature_algorithm": "SHA256withRSA", "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US", "supports_caa": true, "validation_type": null } ], "common_names": [ "ssllabs.com" ], "days_until_expiry": 168, "expires_at": "2027-06-15T23:59:59Z", "from_cache": true, "host": "www.ssllabs.com", "is_expired": false, "is_expiring_soon": false, "issuer": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US", "pending_note": null, "report_ready": true, "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "status": "READY", "timed_out": false, "warn_within_days": 30 } ``` ### Check scan progress Ask how a running assessment is getting on: the status, how far through each endpoint is and how long SSL Labs thinks is left. Never starts a new assessment, so it is safe to call on a loop while one runs. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. **Outputs** - `best_grade` (text) - `cache_expiry_time` (text) - `certificate_hostnames` (list) - `certificates` (list) - `criteria_version` (text) - `endpoint_count` (number) - `endpoint_ips` (list) - `endpoints` (list) - `engine_version` (text) - `eta_seconds` (number) - `failed_endpoints` (list) - `grades` (list) - `has_failed_endpoints` (true/false) - `host` (text) - `is_complete` (true/false) - `is_public` (true/false) - `is_ready` (true/false) - `leaf_certificates` (list) - `overall_progress_percent` (number) - `port` (number) - `protocol` (text) - `report_url` (text) - `start_time` (text) - `status` (text) - `status_message` (text) - `test_time` (text) - `worst_grade` (text) **Example output** ```json { "best_grade": "A+", "cache_expiry_time": null, "certificate_hostnames": [], "certificates": [], "criteria_version": "2009q", "endpoint_count": 1, "endpoint_ips": [ "69.67.183.100" ], "endpoints": [ { "delegation": [ "reachable with the www prefix" ], "details": { "alpn_protocols": "h2 http/1.1", "certificate_chains": [ { "certificate_ids": [ "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a" ], "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77", "is_trusted": true, "issues": [], "no_sni": false } ], "certificate_transparency": [ "SCT in the certificate" ], "dh_prime_count": 0, "drown": { "host_count": 0, "hosts": [], "is_vulnerable": false, "test_errored": false }, "forward_secrecy": [ "achieved with all simulated clients" ], "host_start_time": "2026-08-23T18:24:08Z", "hsts": { "error": null, "header": "max-age=31536000", "include_sub_domains": null, "is_long_enough": true, "is_present": true, "max_age_seconds": 31536000, "preload": null, "status": "present" }, "hsts_preloads": [ { "source": "Chrome", "status": "absent" } ], "http_forwarding": null, "http_status_code": 200, "http_transactions": [ { "request_url": "https://www.ssllabs.com/", "status_code": 200 } ], "implements_tls13_mandatory_suite": true, "insecure_suite_count": 0, "is_hsts_preloaded": false, "known_dh_primes": null, "misc_intolerance": [], "named_groups": [ "x25519", "secp256r1" ], "npn_protocols": null, "obsolete_protocols": [], "ocsp_stapling": true, "offers_obsolete_protocols": false, "protocol_intolerance": [], "protocol_names": [ "TLS 1.2", "TLS 1.3" ], "protocols": [ { "id": 771, "is_obsolete": false, "label": "TLS 1.2", "name": "TLS", "version": "1.2" }, { "id": 772, "is_obsolete": false, "label": "TLS 1.3", "name": "TLS", "version": "1.3" } ], "public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "renegotiation": [ "secure renegotiation supported" ], "reuses_dh_server_value": null, "reuses_ecdhe_parameters": false, "server_signature": "nginx", "session_resumption": "enabled", "simulation": { "failed_count": 16, "failures": [ { "client": "Android 2.3.7", "error": "Protocol mismatch (not simulated)" } ], "simulated_count": 68, "succeeded_count": 52 }, "sni_required": false, "stapled_revocation_status": null, "static_public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "suite_count": 17, "suite_groups": [ { "protocol_id": 771, "server_has_preference": true, "suites": [ { "cipher_strength": 128, "id": 49199, "key_exchange_strength": 3072, "key_exchange_type": "ECDH", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "named_group": "x25519", "strength": "strong" } ] } ], "supports_aead": true, "supports_alpn": true, "supports_cbc": true, "supports_fallback_scsv": true, "supports_heartbeat": false, "supports_npn": false, "supports_rc4": false, "supports_tls12": true, "supports_tls13": true, "vulnerabilities": { "findings": [ { "code": null, "is_vulnerable": false, "key": "heartbleed", "name": "Heartbleed (CVE-2014-0160)", "result": "not vulnerable" }, { "code": 1, "is_vulnerable": false, "key": "bleichenbacher", "name": "ROBOT (Bleichenbacher oracle)", "result": "not vulnerable" } ], "is_vulnerable": false, "vulnerability_count": 0, "vulnerable_to": [] }, "weak_suite_count": 8, "zero_rtt": "not enabled" }, "duration_ms": 47962, "eta_seconds": null, "future_grade": null, "grade": "A+", "grade_trust_ignored": "A+", "has_warnings": false, "ip_address": "69.67.183.100", "is_exceptional": true, "is_ready": true, "progress_percent": 100, "server_name": null, "status_details": null, "status_details_message": null, "status_message": "Ready" } ], "engine_version": "2.4.3", "eta_seconds": null, "failed_endpoints": [], "grades": [ "A+" ], "has_failed_endpoints": false, "host": "www.ssllabs.com", "is_complete": false, "is_public": false, "is_ready": false, "leaf_certificates": [], "overall_progress_percent": 100, "port": 443, "protocol": "http", "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "start_time": "2026-08-23T18:24:08Z", "status": "IN_PROGRESS", "status_message": null, "test_time": null, "worst_grade": "A+" } ``` ### Check the grade Check a host's SSL Labs grade against the lowest grade you will accept, and answer with whether it clears the bar. The gate for a deployment check or a compliance report: it looks at every endpoint, so one badly configured server in a pool cannot hide behind the others. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. - Lowest acceptable grade (`minimum_grade`, text): The grade every endpoint has to reach. T means the certificate is not trusted and M that it does not match the hostname; neither is a passing configuration whatever else the server scores. One of: `A+` (A+ (exceptional)), `A`, `A-` (A- (has warnings)), `B`, `C`, `D`, `E`, `F`, `T` (T (certificate not trusted)), `M` (M (certificate name mismatch)). Default: `A`. - Accept a report up to (hours) old (`max_report_age_hours`, number): How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous. From 1 to 168. Default: `24`. - Wait up to (minutes) (`max_wait_minutes`, number): How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'. From 1 to 15. Default: `5`. **Outputs** - `best_grade` (text) - `endpoint_count` (number) - `failing_endpoint_count` (number) - `failing_endpoints` (list) - `from_cache` (true/false) - `grades` (list) - `host` (text) - `meets_minimum` (true/false) - `minimum_grade` (text) - `pending_note` (text) - `report_ready` (true/false) - `report_url` (text) - `status` (text) - `timed_out` (true/false) - `worst_grade` (text) **Example output** ```json { "best_grade": "A+", "endpoint_count": 1, "failing_endpoint_count": 0, "failing_endpoints": [], "from_cache": true, "grades": [ "A+" ], "host": "www.ssllabs.com", "meets_minimum": true, "minimum_grade": "A", "pending_note": null, "report_ready": true, "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "status": "READY", "timed_out": false, "worst_grade": "A+" } ``` ### Get endpoint details The full assessment of one IP address behind a hostname: its grade, protocols, cipher suites, HSTS policy, certificate chain and every vulnerability test. A hostname on a CDN can answer from a dozen addresses with different configurations, and this reads one of them. Never starts an assessment. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. - Endpoint IP address (`endpoint_ip`, text, required): Which of the host's addresses to read. The addresses come from the 'endpoint_ips' list on a scan result. - Allow a stored report (`from_cache`, true/false): Turn on to accept the stored assessment of this endpoint rather than the live one. Default: `false`. **Outputs** - `delegation` (list) - `details` (object) - `duration_ms` (number) - `eta_seconds` (number) - `future_grade` (text) - `grade` (text) - `grade_trust_ignored` (text) - `has_warnings` (true/false) - `host` (text) - `ip_address` (text) - `is_exceptional` (true/false) - `is_ready` (true/false) - `progress_percent` (number) - `report_url` (text) - `server_name` (text) - `status_details` (text) - `status_details_message` (text) - `status_message` (text) **Example output** ```json { "delegation": [ "reachable with the www prefix" ], "details": { "alpn_protocols": "h2 http/1.1", "certificate_chains": [ { "certificate_ids": [ "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a" ], "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77", "is_trusted": true, "issues": [], "no_sni": false } ], "certificate_transparency": [ "SCT in the certificate" ], "dh_prime_count": 0, "drown": { "host_count": 0, "hosts": [], "is_vulnerable": false, "test_errored": false }, "forward_secrecy": [ "achieved with all simulated clients" ], "host_start_time": "2026-08-23T18:24:08Z", "hsts": { "error": null, "header": "max-age=31536000", "include_sub_domains": null, "is_long_enough": true, "is_present": true, "max_age_seconds": 31536000, "preload": null, "status": "present" }, "hsts_preloads": [ { "source": "Chrome", "status": "absent" } ], "http_forwarding": null, "http_status_code": 200, "http_transactions": [ { "request_url": "https://www.ssllabs.com/", "status_code": 200 } ], "implements_tls13_mandatory_suite": true, "insecure_suite_count": 0, "is_hsts_preloaded": false, "known_dh_primes": null, "misc_intolerance": [], "named_groups": [ "x25519", "secp256r1" ], "npn_protocols": null, "obsolete_protocols": [], "ocsp_stapling": true, "offers_obsolete_protocols": false, "protocol_intolerance": [], "protocol_names": [ "TLS 1.2", "TLS 1.3" ], "protocols": [ { "id": 771, "is_obsolete": false, "label": "TLS 1.2", "name": "TLS", "version": "1.2" }, { "id": 772, "is_obsolete": false, "label": "TLS 1.3", "name": "TLS", "version": "1.3" } ], "public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "renegotiation": [ "secure renegotiation supported" ], "reuses_dh_server_value": null, "reuses_ecdhe_parameters": false, "server_signature": "nginx", "session_resumption": "enabled", "simulation": { "failed_count": 16, "failures": [ { "client": "Android 2.3.7", "error": "Protocol mismatch (not simulated)" } ], "simulated_count": 68, "succeeded_count": 52 }, "sni_required": false, "stapled_revocation_status": null, "static_public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "suite_count": 17, "suite_groups": [ { "protocol_id": 771, "server_has_preference": true, "suites": [ { "cipher_strength": 128, "id": 49199, "key_exchange_strength": 3072, "key_exchange_type": "ECDH", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "named_group": "x25519", "strength": "strong" } ] } ], "supports_aead": true, "supports_alpn": true, "supports_cbc": true, "supports_fallback_scsv": true, "supports_heartbeat": false, "supports_npn": false, "supports_rc4": false, "supports_tls12": true, "supports_tls13": true, "vulnerabilities": { "findings": [ { "code": null, "is_vulnerable": false, "key": "heartbleed", "name": "Heartbleed (CVE-2014-0160)", "result": "not vulnerable" }, { "code": 1, "is_vulnerable": false, "key": "bleichenbacher", "name": "ROBOT (Bleichenbacher oracle)", "result": "not vulnerable" } ], "is_vulnerable": false, "vulnerability_count": 0, "vulnerable_to": [] }, "weak_suite_count": 8, "zero_rtt": "not enabled" }, "duration_ms": 47962, "eta_seconds": null, "future_grade": null, "grade": "A+", "grade_trust_ignored": "A+", "has_warnings": false, "host": "www.ssllabs.com", "ip_address": "69.67.183.100", "is_exceptional": true, "is_ready": true, "progress_percent": 100, "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "server_name": null, "status_details": null, "status_details_message": null, "status_message": "Ready" } ``` ### Get service status Whether SSL Labs is up, which grading criteria it is applying and how many assessments this registration may run at once against how many are already running. Run it before a batch of scans to see how many will fit. **Inputs**: None. **Outputs** - `available_assessments` (number) - `can_start_assessment` (true/false) - `criteria_version` (text) - `current_assessments` (number) - `engine_version` (text) - `max_assessments` (number) - `messages` (list) - `new_assessment_cool_off_ms` (number) **Example output** ```json { "available_assessments": 7, "can_start_assessment": true, "criteria_version": "2009q", "current_assessments": 0, "engine_version": "2.4.3", "max_assessments": 7, "messages": [ "This assessment service is provided free of charge by Qualys SSL Labs, subject to our terms and conditions: https://www.ssllabs.com/about/terms.html" ], "new_assessment_cool_off_ms": 1000 } ``` ### Get the last report Read the report SSL Labs already holds for a host, without waiting. The cheapest way to read a grade. If nothing recent enough is stored, SSL Labs starts an assessment and this returns its status rather than waiting for it. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. - Accept a report up to (hours) old (`max_report_age_hours`, number): How old the stored report may be. Leave empty to accept whatever SSL Labs holds, however old. From 1 to 168. **Outputs** - `assessment_started` (true/false) - `best_grade` (text) - `cache_expiry_time` (text) - `certificate_hostnames` (list) - `certificates` (list) - `criteria_version` (text) - `endpoint_count` (number) - `endpoint_ips` (list) - `endpoints` (list) - `engine_version` (text) - `failed_endpoints` (list) - `grades` (list) - `has_failed_endpoints` (true/false) - `host` (text) - `is_complete` (true/false) - `is_public` (true/false) - `is_ready` (true/false) - `leaf_certificates` (list) - `max_report_age_hours` (number) - `port` (number) - `protocol` (text) - `report_url` (text) - `start_time` (text) - `status` (text) - `status_message` (text) - `test_time` (text) - `worst_grade` (text) **Example output** ```json { "assessment_started": false, "best_grade": "A+", "cache_expiry_time": null, "certificate_hostnames": [ "ssllabs.com", "www.ssllabs.com" ], "certificates": [ { "alt_names": [ "ssllabs.com", "www.ssllabs.com" ], "caa_records": [ { "flags": 0, "tag": "issue", "value": "pki.goog" } ], "common_names": [ "ssllabs.com" ], "crl_uris": [ "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl" ], "days_until_expiry": 168, "has_issues": false, "has_sct": true, "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "is_expired": false, "is_revoked": false, "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US", "issues": [], "key_algorithm": "RSA", "key_size": 2048, "key_strength": 2048, "must_staple": false, "not_after": "2027-06-15T23:59:59Z", "not_before": "2026-05-20T00:00:00Z", "ocsp_uris": [ "http://ocsp.digicert.com" ], "pem": null, "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=", "revocation_status": "not revoked", "serial_number": "0a8b2d0e1f3c4b5a6978", "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "signature_algorithm": "SHA256withRSA", "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US", "supports_caa": true, "validation_type": null } ], "criteria_version": "2009q", "endpoint_count": 1, "endpoint_ips": [ "69.67.183.100" ], "endpoints": [ { "delegation": [ "reachable with the www prefix" ], "details": { "alpn_protocols": "h2 http/1.1", "certificate_chains": [ { "certificate_ids": [ "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a" ], "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77", "is_trusted": true, "issues": [], "no_sni": false } ], "certificate_transparency": [ "SCT in the certificate" ], "dh_prime_count": 0, "drown": { "host_count": 0, "hosts": [], "is_vulnerable": false, "test_errored": false }, "forward_secrecy": [ "achieved with all simulated clients" ], "host_start_time": "2026-08-23T18:24:08Z", "hsts": { "error": null, "header": "max-age=31536000", "include_sub_domains": null, "is_long_enough": true, "is_present": true, "max_age_seconds": 31536000, "preload": null, "status": "present" }, "hsts_preloads": [ { "source": "Chrome", "status": "absent" } ], "http_forwarding": null, "http_status_code": 200, "http_transactions": [ { "request_url": "https://www.ssllabs.com/", "status_code": 200 } ], "implements_tls13_mandatory_suite": true, "insecure_suite_count": 0, "is_hsts_preloaded": false, "known_dh_primes": null, "misc_intolerance": [], "named_groups": [ "x25519", "secp256r1" ], "npn_protocols": null, "obsolete_protocols": [], "ocsp_stapling": true, "offers_obsolete_protocols": false, "protocol_intolerance": [], "protocol_names": [ "TLS 1.2", "TLS 1.3" ], "protocols": [ { "id": 771, "is_obsolete": false, "label": "TLS 1.2", "name": "TLS", "version": "1.2" }, { "id": 772, "is_obsolete": false, "label": "TLS 1.3", "name": "TLS", "version": "1.3" } ], "public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "renegotiation": [ "secure renegotiation supported" ], "reuses_dh_server_value": null, "reuses_ecdhe_parameters": false, "server_signature": "nginx", "session_resumption": "enabled", "simulation": { "failed_count": 16, "failures": [ { "client": "Android 2.3.7", "error": "Protocol mismatch (not simulated)" } ], "simulated_count": 68, "succeeded_count": 52 }, "sni_required": false, "stapled_revocation_status": null, "static_public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "suite_count": 17, "suite_groups": [ { "protocol_id": 771, "server_has_preference": true, "suites": [ { "cipher_strength": 128, "id": 49199, "key_exchange_strength": 3072, "key_exchange_type": "ECDH", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "named_group": "x25519", "strength": "strong" } ] } ], "supports_aead": true, "supports_alpn": true, "supports_cbc": true, "supports_fallback_scsv": true, "supports_heartbeat": false, "supports_npn": false, "supports_rc4": false, "supports_tls12": true, "supports_tls13": true, "vulnerabilities": { "findings": [ { "code": null, "is_vulnerable": false, "key": "heartbleed", "name": "Heartbleed (CVE-2014-0160)", "result": "not vulnerable" }, { "code": 1, "is_vulnerable": false, "key": "bleichenbacher", "name": "ROBOT (Bleichenbacher oracle)", "result": "not vulnerable" } ], "is_vulnerable": false, "vulnerability_count": 0, "vulnerable_to": [] }, "weak_suite_count": 8, "zero_rtt": "not enabled" }, "duration_ms": 47962, "eta_seconds": null, "future_grade": null, "grade": "A+", "grade_trust_ignored": "A+", "has_warnings": false, "ip_address": "69.67.183.100", "is_exceptional": true, "is_ready": true, "progress_percent": 100, "server_name": null, "status_details": null, "status_details_message": null, "status_message": "Ready" } ], "engine_version": "2.4.3", "failed_endpoints": [], "grades": [ "A+" ], "has_failed_endpoints": false, "host": "www.ssllabs.com", "is_complete": true, "is_public": false, "is_ready": true, "leaf_certificates": [ { "alt_names": [ "ssllabs.com", "www.ssllabs.com" ], "caa_records": [ { "flags": 0, "tag": "issue", "value": "pki.goog" } ], "common_names": [ "ssllabs.com" ], "crl_uris": [ "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl" ], "days_until_expiry": 168, "has_issues": false, "has_sct": true, "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "is_expired": false, "is_revoked": false, "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US", "issues": [], "key_algorithm": "RSA", "key_size": 2048, "key_strength": 2048, "must_staple": false, "not_after": "2027-06-15T23:59:59Z", "not_before": "2026-05-20T00:00:00Z", "ocsp_uris": [ "http://ocsp.digicert.com" ], "pem": null, "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=", "revocation_status": "not revoked", "serial_number": "0a8b2d0e1f3c4b5a6978", "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "signature_algorithm": "SHA256withRSA", "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US", "supports_caa": true, "validation_type": null } ], "max_report_age_hours": 24, "port": 443, "protocol": "http", "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "start_time": "2026-08-23T18:24:08Z", "status": "READY", "status_message": null, "test_time": "2026-08-23T18:24:57Z", "worst_grade": "A+" } ``` ### List assessment status codes The codes an assessment reports while it runs, with what each one means. 'Check scan progress' returns a code such as TESTING_HEARTBLEED, and this is the table that turns it into 'Testing Heartbleed'. **Inputs**: None. **Outputs** - `codes` (list) - `status_code_count` (number) - `status_codes` (list) **Example output** ```json { "codes": [ "TESTING_HEARTBLEED", "PREPARING_REPORT" ], "status_code_count": 2, "status_codes": [ { "code": "TESTING_HEARTBLEED", "message": "Testing Heartbleed" }, { "code": "PREPARING_REPORT", "message": "Preparing the report" } ] } ``` ### List root certificates The root certificates in one of the five trust stores SSL Labs validates chains against: Mozilla, Apple macOS, Android, Java and Windows. Each root comes back with its name, subject, key and validity dates, and the days it has left, so you can see which roots are about to age out. The PEM itself is left out unless you ask for it. **Inputs** - Trust store (`trust_store`, text): Whose list of trusted roots to read. One of: `1` (Mozilla), `2` (Apple macOS), `3` (Android), `4` (Java), `5` (Windows). Default: `1`. - Search (`search`, text): Return only the roots whose name or subject contains this text, for example 'DigiCert' or 'ISRG'. Leave empty for all of them. - Include the PEM certificate (`include_pem`, true/false): Turn on to include each root's PEM text. Off by default: a whole trust store runs to about a megabyte of it. Default: `false`. - Maximum roots to return (`limit`, number): How many matching roots to return. The largest store holds a little over five hundred. From 1 to 1000. Default: `100`. **Outputs** - `certificate_count` (number) - `certificates` (list) - `includes_pem` (true/false) - `matched_count` (number) - `search` (text) - `total_count` (number) - `trust_store` (text) - `trust_store_name` (text) - `trust_store_version` (text) **Example output** ```json { "certificate_count": 1, "certificates": [ { "days_until_expiry": 3207, "is_expired": false, "key_algorithm": "RSA", "key_size": 4096, "name": "ISRG Root X1", "not_after": "2035-06-04T11:04:38Z", "not_before": "2015-06-04T11:04:38Z", "pem": null, "subject": "CN=ISRG Root X1, O=Internet Security Research Group, C=US" } ], "includes_pem": false, "matched_count": 1, "search": "ISRG", "total_count": 150, "trust_store": "1", "trust_store_name": "Mozilla", "trust_store_version": "Mozilla(Mozilla)" } ``` ### List vulnerabilities Every vulnerability test SSL Labs ran on a host, endpoint by endpoint, in plain words: Heartbleed, ROBOT, POODLE, GOLDENDOODLE, Ticketbleed, DROWN, FREAK, Logjam, BEAST and the rest, each with its result and whether the server is actually vulnerable. Also reports obsolete protocols and how many weak or insecure cipher suites are on offer. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. - Accept a report up to (hours) old (`max_report_age_hours`, number): How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous. From 1 to 168. Default: `24`. - Wait up to (minutes) (`max_wait_minutes`, number): How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'. From 1 to 15. Default: `5`. **Outputs** - `endpoint_count` (number) - `endpoints` (list) - `from_cache` (true/false) - `host` (text) - `is_vulnerable` (true/false) - `pending_note` (text) - `report_ready` (true/false) - `report_url` (text) - `status` (text) - `timed_out` (true/false) - `vulnerability_count` (number) - `vulnerable_to` (list) **Example output** ```json { "endpoint_count": 1, "endpoints": [ { "findings": [ { "code": null, "is_vulnerable": false, "key": "heartbleed", "name": "Heartbleed (CVE-2014-0160)", "result": "not vulnerable" } ], "grade": "A+", "insecure_suite_count": 0, "ip_address": "69.67.183.100", "is_vulnerable": false, "obsolete_protocols": [], "vulnerable_to": [], "weak_suite_count": 8 } ], "from_cache": true, "host": "www.ssllabs.com", "is_vulnerable": false, "pending_note": null, "report_ready": true, "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "status": "READY", "timed_out": false, "vulnerability_count": 0, "vulnerable_to": [] } ``` ### Register for API access Register an email address for SSL Labs API access. Connecting this integration already registers the address you connected with, so this is for registering a second one. SSL Labs does not accept free mail domains such as Gmail, Yahoo or Hotmail: the address has to be an organization one. **Inputs** - First name (`first_name`, text, required): The first name to register. - Last name (`last_name`, text, required): The last name to register. - Organization (`organization`, text, required): The organization the address belongs to. - Email address (`email`, text): The work address to register. Leave empty to register the address this integration is connected with. **Outputs** - `email` (text) - `is_registered` (true/false) - `message` (text) - `status` (text) - `was_already_registered` (true/false) **Example output** ```json { "email": "you@yourcompany.com", "is_registered": true, "message": "User successfully registered", "status": "success", "was_already_registered": false } ``` ### Scan a host Assess a host's TLS configuration and wait for the result: the grade for every IP behind the hostname, the certificate chain, the protocols and cipher suites on offer and the vulnerability tests. Uses a stored report when there is a recent one and runs a fresh assessment otherwise, so a scheduled check is cheap to repeat. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. - Use a stored report when there is one (`use_cached_report`, true/false): On by default: a report younger than the age below is returned straight away. Turn off to always run a fresh assessment, which takes a few minutes and counts against the assessment limit. Default: `true`. - Accept a report up to (hours) old (`max_report_age_hours`, number): How old a stored report may be before a fresh assessment is run instead. Assessments are rate limited and deliberately slow, so a scheduled check should leave this generous. From 1 to 168. Default: `24`. - Wait up to (minutes) (`max_wait_minutes`, number): How long this step may wait for the assessment to finish. An assessment usually takes one to three minutes, and longer for a host with several IP addresses because they are tested one at a time. If the wait runs out the answer says so and the assessment carries on at SSL Labs, ready for 'Check scan progress'. From 1 to 15. Default: `5`. - Publish the result publicly (`publish`, true/false): Turn on to list the result on the public SSL Labs boards at ssllabs.com. Off by default: results stay unlisted. Default: `false`. - Assess even if the certificate name does not match (`ignore_certificate_mismatch`, true/false): Turn on to carry on assessing a server whose certificate is issued for a different hostname. Off by default, when SSL Labs stops and reports the mismatch instead. Default: `false`. **Outputs** - `best_grade` (text) - `cache_expiry_time` (text) - `certificate_hostnames` (list) - `certificates` (list) - `criteria_version` (text) - `endpoint_count` (number) - `endpoint_ips` (list) - `endpoints` (list) - `engine_version` (text) - `failed_endpoints` (list) - `from_cache` (true/false) - `grades` (list) - `has_failed_endpoints` (true/false) - `host` (text) - `is_complete` (true/false) - `is_public` (true/false) - `is_ready` (true/false) - `leaf_certificates` (list) - `pending_note` (text) - `poll_count` (number) - `port` (number) - `protocol` (text) - `report_url` (text) - `start_time` (text) - `status` (text) - `status_message` (text) - `test_time` (text) - `timed_out` (true/false) - `waited_seconds` (number) - `worst_grade` (text) **Example output** ```json { "best_grade": "A+", "cache_expiry_time": null, "certificate_hostnames": [ "ssllabs.com", "www.ssllabs.com" ], "certificates": [ { "alt_names": [ "ssllabs.com", "www.ssllabs.com" ], "caa_records": [ { "flags": 0, "tag": "issue", "value": "pki.goog" } ], "common_names": [ "ssllabs.com" ], "crl_uris": [ "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl" ], "days_until_expiry": 168, "has_issues": false, "has_sct": true, "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "is_expired": false, "is_revoked": false, "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US", "issues": [], "key_algorithm": "RSA", "key_size": 2048, "key_strength": 2048, "must_staple": false, "not_after": "2027-06-15T23:59:59Z", "not_before": "2026-05-20T00:00:00Z", "ocsp_uris": [ "http://ocsp.digicert.com" ], "pem": null, "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=", "revocation_status": "not revoked", "serial_number": "0a8b2d0e1f3c4b5a6978", "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "signature_algorithm": "SHA256withRSA", "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US", "supports_caa": true, "validation_type": null } ], "criteria_version": "2009q", "endpoint_count": 1, "endpoint_ips": [ "69.67.183.100" ], "endpoints": [ { "delegation": [ "reachable with the www prefix" ], "details": { "alpn_protocols": "h2 http/1.1", "certificate_chains": [ { "certificate_ids": [ "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a" ], "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77", "is_trusted": true, "issues": [], "no_sni": false } ], "certificate_transparency": [ "SCT in the certificate" ], "dh_prime_count": 0, "drown": { "host_count": 0, "hosts": [], "is_vulnerable": false, "test_errored": false }, "forward_secrecy": [ "achieved with all simulated clients" ], "host_start_time": "2026-08-23T18:24:08Z", "hsts": { "error": null, "header": "max-age=31536000", "include_sub_domains": null, "is_long_enough": true, "is_present": true, "max_age_seconds": 31536000, "preload": null, "status": "present" }, "hsts_preloads": [ { "source": "Chrome", "status": "absent" } ], "http_forwarding": null, "http_status_code": 200, "http_transactions": [ { "request_url": "https://www.ssllabs.com/", "status_code": 200 } ], "implements_tls13_mandatory_suite": true, "insecure_suite_count": 0, "is_hsts_preloaded": false, "known_dh_primes": null, "misc_intolerance": [], "named_groups": [ "x25519", "secp256r1" ], "npn_protocols": null, "obsolete_protocols": [], "ocsp_stapling": true, "offers_obsolete_protocols": false, "protocol_intolerance": [], "protocol_names": [ "TLS 1.2", "TLS 1.3" ], "protocols": [ { "id": 771, "is_obsolete": false, "label": "TLS 1.2", "name": "TLS", "version": "1.2" }, { "id": 772, "is_obsolete": false, "label": "TLS 1.3", "name": "TLS", "version": "1.3" } ], "public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "renegotiation": [ "secure renegotiation supported" ], "reuses_dh_server_value": null, "reuses_ecdhe_parameters": false, "server_signature": "nginx", "session_resumption": "enabled", "simulation": { "failed_count": 16, "failures": [ { "client": "Android 2.3.7", "error": "Protocol mismatch (not simulated)" } ], "simulated_count": 68, "succeeded_count": 52 }, "sni_required": false, "stapled_revocation_status": null, "static_public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "suite_count": 17, "suite_groups": [ { "protocol_id": 771, "server_has_preference": true, "suites": [ { "cipher_strength": 128, "id": 49199, "key_exchange_strength": 3072, "key_exchange_type": "ECDH", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "named_group": "x25519", "strength": "strong" } ] } ], "supports_aead": true, "supports_alpn": true, "supports_cbc": true, "supports_fallback_scsv": true, "supports_heartbeat": false, "supports_npn": false, "supports_rc4": false, "supports_tls12": true, "supports_tls13": true, "vulnerabilities": { "findings": [ { "code": null, "is_vulnerable": false, "key": "heartbleed", "name": "Heartbleed (CVE-2014-0160)", "result": "not vulnerable" }, { "code": 1, "is_vulnerable": false, "key": "bleichenbacher", "name": "ROBOT (Bleichenbacher oracle)", "result": "not vulnerable" } ], "is_vulnerable": false, "vulnerability_count": 0, "vulnerable_to": [] }, "weak_suite_count": 8, "zero_rtt": "not enabled" }, "duration_ms": 47962, "eta_seconds": null, "future_grade": null, "grade": "A+", "grade_trust_ignored": "A+", "has_warnings": false, "ip_address": "69.67.183.100", "is_exceptional": true, "is_ready": true, "progress_percent": 100, "server_name": null, "status_details": null, "status_details_message": null, "status_message": "Ready" } ], "engine_version": "2.4.3", "failed_endpoints": [], "from_cache": true, "grades": [ "A+" ], "has_failed_endpoints": false, "host": "www.ssllabs.com", "is_complete": true, "is_public": false, "is_ready": true, "leaf_certificates": [ { "alt_names": [ "ssllabs.com", "www.ssllabs.com" ], "caa_records": [ { "flags": 0, "tag": "issue", "value": "pki.goog" } ], "common_names": [ "ssllabs.com" ], "crl_uris": [ "http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl" ], "days_until_expiry": 168, "has_issues": false, "has_sct": true, "id": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "is_expired": false, "is_revoked": false, "issuer_subject": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US", "issues": [], "key_algorithm": "RSA", "key_size": 2048, "key_strength": 2048, "must_staple": false, "not_after": "2027-06-15T23:59:59Z", "not_before": "2026-05-20T00:00:00Z", "ocsp_uris": [ "http://ocsp.digicert.com" ], "pem": null, "pin_sha256": "Bo2GdQ8mQ0dcMfeQ0mR1sXJmY0Gk1Rk6zJmuJ7T4G1o=", "revocation_status": "not revoked", "serial_number": "0a8b2d0e1f3c4b5a6978", "sha256_hash": "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a", "signature_algorithm": "SHA256withRSA", "subject": "CN=ssllabs.com, O=Qualys, Inc., L=Foster City, ST=California, C=US", "supports_caa": true, "validation_type": null } ], "pending_note": null, "poll_count": 0, "port": 443, "protocol": "http", "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "start_time": "2026-08-23T18:24:08Z", "status": "READY", "status_message": null, "test_time": "2026-08-23T18:24:57Z", "timed_out": false, "waited_seconds": 0, "worst_grade": "A+" } ``` ### Start a scan Start a fresh assessment and return straight away, without waiting for it. For a host that takes longer to assess than a step should sit and wait: start it here, then read the result later with 'Check scan progress' or 'Get the last report'. **Inputs** - Hostname (`host`, text, required): The public hostname to assess, such as example.com. SSL Labs always tests port 443. A full URL is accepted and reduced to its hostname. - Publish the result publicly (`publish`, true/false): Turn on to list the result on the public SSL Labs boards at ssllabs.com. Off by default: results stay unlisted. Default: `false`. - Assess even if the certificate name does not match (`ignore_certificate_mismatch`, true/false): Turn on to carry on assessing a server whose certificate is issued for a different hostname. Off by default, when SSL Labs stops and reports the mismatch instead. Default: `false`. **Outputs** - `best_grade` (text) - `cache_expiry_time` (text) - `certificate_hostnames` (list) - `certificates` (list) - `criteria_version` (text) - `endpoint_count` (number) - `endpoint_ips` (list) - `endpoints` (list) - `engine_version` (text) - `failed_endpoints` (list) - `grades` (list) - `has_failed_endpoints` (true/false) - `host` (text) - `is_complete` (true/false) - `is_public` (true/false) - `is_ready` (true/false) - `leaf_certificates` (list) - `port` (number) - `protocol` (text) - `report_url` (text) - `start_time` (text) - `started` (true/false) - `status` (text) - `status_message` (text) - `test_time` (text) - `worst_grade` (text) **Example output** ```json { "best_grade": null, "cache_expiry_time": null, "certificate_hostnames": [], "certificates": [], "criteria_version": "2009q", "endpoint_count": 1, "endpoint_ips": [ "69.67.183.100" ], "endpoints": [ { "delegation": [ "reachable with the www prefix" ], "details": { "alpn_protocols": "h2 http/1.1", "certificate_chains": [ { "certificate_ids": [ "bb60250e7ccdbe79553b8ee08f62bd6154e01d8b16c503420c0615097df9945a" ], "id": "4a55386c511fac746a3621ce611fb725d2af10e4ec4684538a1cf0d9581b0b77", "is_trusted": true, "issues": [], "no_sni": false } ], "certificate_transparency": [ "SCT in the certificate" ], "dh_prime_count": 0, "drown": { "host_count": 0, "hosts": [], "is_vulnerable": false, "test_errored": false }, "forward_secrecy": [ "achieved with all simulated clients" ], "host_start_time": "2026-08-23T18:24:08Z", "hsts": { "error": null, "header": "max-age=31536000", "include_sub_domains": null, "is_long_enough": true, "is_present": true, "max_age_seconds": 31536000, "preload": null, "status": "present" }, "hsts_preloads": [ { "source": "Chrome", "status": "absent" } ], "http_forwarding": null, "http_status_code": 200, "http_transactions": [ { "request_url": "https://www.ssllabs.com/", "status_code": 200 } ], "implements_tls13_mandatory_suite": true, "insecure_suite_count": 0, "is_hsts_preloaded": false, "known_dh_primes": null, "misc_intolerance": [], "named_groups": [ "x25519", "secp256r1" ], "npn_protocols": null, "obsolete_protocols": [], "ocsp_stapling": true, "offers_obsolete_protocols": false, "protocol_intolerance": [], "protocol_names": [ "TLS 1.2", "TLS 1.3" ], "protocols": [ { "id": 771, "is_obsolete": false, "label": "TLS 1.2", "name": "TLS", "version": "1.2" }, { "id": 772, "is_obsolete": false, "label": "TLS 1.3", "name": "TLS", "version": "1.3" } ], "public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "renegotiation": [ "secure renegotiation supported" ], "reuses_dh_server_value": null, "reuses_ecdhe_parameters": false, "server_signature": "nginx", "session_resumption": "enabled", "simulation": { "failed_count": 16, "failures": [ { "client": "Android 2.3.7", "error": "Protocol mismatch (not simulated)" } ], "simulated_count": 68, "succeeded_count": 52 }, "sni_required": false, "stapled_revocation_status": null, "static_public_key_pinning": { "error": null, "include_sub_domains": null, "max_age_seconds": null, "pin_count": 0, "report_uri": null, "status": "absent" }, "suite_count": 17, "suite_groups": [ { "protocol_id": 771, "server_has_preference": true, "suites": [ { "cipher_strength": 128, "id": 49199, "key_exchange_strength": 3072, "key_exchange_type": "ECDH", "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "named_group": "x25519", "strength": "strong" } ] } ], "supports_aead": true, "supports_alpn": true, "supports_cbc": true, "supports_fallback_scsv": true, "supports_heartbeat": false, "supports_npn": false, "supports_rc4": false, "supports_tls12": true, "supports_tls13": true, "vulnerabilities": { "findings": [ { "code": null, "is_vulnerable": false, "key": "heartbleed", "name": "Heartbleed (CVE-2014-0160)", "result": "not vulnerable" }, { "code": 1, "is_vulnerable": false, "key": "bleichenbacher", "name": "ROBOT (Bleichenbacher oracle)", "result": "not vulnerable" } ], "is_vulnerable": false, "vulnerability_count": 0, "vulnerable_to": [] }, "weak_suite_count": 8, "zero_rtt": "not enabled" }, "duration_ms": 47962, "eta_seconds": null, "future_grade": null, "grade": "A+", "grade_trust_ignored": "A+", "has_warnings": false, "ip_address": "69.67.183.100", "is_exceptional": true, "is_ready": true, "progress_percent": 100, "server_name": null, "status_details": null, "status_details_message": null, "status_message": "Ready" } ], "engine_version": "2.4.3", "failed_endpoints": [], "grades": [], "has_failed_endpoints": false, "host": "www.ssllabs.com", "is_complete": false, "is_public": false, "is_ready": false, "leaf_certificates": [], "port": 443, "protocol": "http", "report_url": "https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.com", "start_time": "2026-08-23T18:24:08Z", "started": true, "status": "IN_PROGRESS", "status_message": null, "test_time": null, "worst_grade": null } ```