> ## Documentation Index > Fetch the complete documentation index at: https://docs.geekflare.com/llms.txt > Use this file to discover all available pages before exploring further. # TLS Scan > Inspect a domain's TLS/SSL configuration, including which protocol versions are supported (from the deprecated and insecure SSLv2/SSLv3 through TLS 1.3) and certificate details, to catch expiring certificates and outdated, insecure configurations. ## OpenAPI ````yaml POST /tlsscan openapi: 3.1.0 info: title: Geekflare description: Official OpenAPI specification for all Geekflare endpoints. version: 1.0.0 license: name: MIT servers: - url: https://api.geekflare.com security: - x-api-key: [] paths: /tlsscan: post: tags: - api-tool summary: Perform TLS scan for a given domain description: >- Inspect a domain's TLS/SSL configuration, including which protocol versions are supported (from the deprecated and insecure SSLv2/SSLv3 through TLS 1.3) and certificate details, to catch expiring certificates and outdated, insecure configurations. operationId: tlsScan parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/TlsScanDto' responses: '200': description: Successfully retrieved TLS scan information content: application/json: schema: $ref: '#/components/schemas/TlsScanResponseDto' example: timestamp: 1786985154370 apiStatus: success apiCode: 200 meta: url: example.com test: id: 25075387-6ffd-4779-94b5-2304d77c8f77 data: protocols: ssl2: true ssl3: true tls10: true tls11: true tls12: true tls13: false certificate: commonName: '*.example.com' subjectAltName: DNS:*.example.com, DNS:example.com issuer: country: GB organization: Sectigo Limited commonName: Sectigo Public Server Authentication CA OV R36 expiry: Sep 30 23:59:59 2026 GMT '400': description: Invalid URL. content: application/json: schema: $ref: '#/components/schemas/BaseErrorResponseDto' example: timestamp: 1700000000000 apiStatus: failure apiCode: 400 message: INVALID_URL details: The URL must be a valid HTTP or HTTPS URL. '422': description: TLS handshake failed. content: application/json: schema: $ref: '#/components/schemas/BaseErrorResponseDto' example: timestamp: 1700000000000 apiStatus: failure apiCode: 422 message: TLS_HANDSHAKE_FAILED details: Unable to establish a TLS connection with the target server. '500': description: TLS scan failed. content: application/json: schema: $ref: '#/components/schemas/BaseErrorResponseDto' example: timestamp: 1700000000000 apiStatus: failure apiCode: 500 message: TLS_SCAN_FAILED details: Unable to complete the TLS scan for the target domain. components: schemas: TlsScanDto: type: object properties: url: type: string description: Target URL example: https://example.com required: - url TlsScanResponseDto: type: object properties: timestamp: type: number description: Timestamp of the request in milliseconds example: 1788851167291 apiStatus: type: string description: API status message example: success enum: - success - failure apiCode: type: number description: API status code example: 200 meta: description: Metadata about the TLS scan request example: url: example.com test: id: 40zt4but04y07ccn4pov5fiolzrxbxdg allOf: - $ref: '#/components/schemas/TlsScanMetaDto' data: description: TLS scan result data example: protocols: ssl2: false ssl3: false tls10: false tls11: false tls12: true tls13: true certificate: commonName: sni.cloudflaressl.com subjectAltName: DNS:*.example.com, DNS:sni.cloudflaressl.com, DNS:example.com issuer: country: US organization: Cloudflare, Inc. commonName: Cloudflare Inc ECC CA-3 expiry: Jun 6 23:59:59 2023 GMT allOf: - $ref: '#/components/schemas/TlsScanDataDto' required: - timestamp - apiStatus - apiCode - meta - data BaseErrorResponseDto: type: object properties: timestamp: type: number description: Timestamp of the request in milliseconds example: 1778737930991 apiStatus: type: string description: API status message example: success enum: - success - failure apiCode: type: number description: API status code example: 200 message: type: string description: Error message example: Invalid URL provided details: type: string description: Detailed error information example: The URL must be a valid HTTP or HTTPS URL required: - timestamp - apiStatus - apiCode - message TlsScanMetaDto: type: object properties: url: type: string description: The target URL checked for TLS support example: example.com test: description: Test metadata object example: id: 40zt4but04y07ccn4pov5fiolzrxbxdg allOf: - $ref: '#/components/schemas/TestMetaDto' required: - url - test TlsScanDataDto: type: object properties: protocols: description: Protocols supported allOf: - $ref: '#/components/schemas/TlsProtocolsDto' certificate: description: Certificate details allOf: - $ref: '#/components/schemas/TlsCertificateDto' vulnerabilities: description: Category A vulnerability findings (definitive pass/fail) allOf: - $ref: '#/components/schemas/TlsVulnerabilitiesDto' advisory: description: Category B advisory signals (informational, not a verdict) allOf: - $ref: '#/components/schemas/TlsAdvisoryDto' required: - protocols - certificate - vulnerabilities - advisory TestMetaDto: type: object properties: id: type: string description: Unique test identifier example: mxqx9v9y0742lap6altwdteqd28t23nq required: - id TlsProtocolsDto: type: object properties: ssl2: type: boolean description: Whether the deprecated and insecure SSL 2.0 is supported example: false ssl3: type: boolean description: Whether the deprecated and insecure SSL 3.0 is supported example: false tls10: type: boolean description: Whether TLS 1.0 is supported example: false tls11: type: boolean description: Whether TLS 1.1 is supported example: false tls12: type: boolean description: Whether TLS 1.2 is supported example: true tls13: type: boolean description: Whether TLS 1.3 is supported example: true required: - ssl2 - ssl3 - tls10 - tls11 - tls12 - tls13 TlsCertificateDto: type: object properties: commonName: type: string description: Common name (CN) on the certificate example: sni.cloudflaressl.com subjectAltName: type: string description: Subject Alternative Names (SAN) example: DNS:*.example.com, DNS:sni.cloudflaressl.com, DNS:example.com issuer: description: Issuer details allOf: - $ref: '#/components/schemas/TlsCertificateIssuerDto' expiry: type: string description: Certificate expiry date example: Jun 6 23:59:59 2023 GMT validFrom: type: string description: Certificate valid-from date isExpired: type: boolean description: Whether the certificate has expired isNotYetValid: type: boolean description: Whether the certificate is not yet valid hostnameMatches: type: boolean description: Whether the requested hostname matches the certificate (CN/SAN) selfSigned: type: boolean description: Whether the leaf certificate is self-signed keyBits: type: object description: Public key size in bits, null if not an RSA key nullable: true weakKey: type: object description: >- Whether the key size is considered weak (RSA < 2048 bits), null if not applicable nullable: true weakSignatureAlgorithm: type: object description: >- Whether the certificate uses a weak signature algorithm (SHA-1/MD5); heuristic OID scan, null if undeterminable nullable: true chain: description: Certificate chain analysis allOf: - $ref: '#/components/schemas/TlsCertificateChainDto' forwardSecrecy: description: Forward secrecy signal from the negotiated handshake allOf: - $ref: '#/components/schemas/TlsForwardSecrecyDto' trusted: type: boolean description: >- Whether the chain validates against Node/OpenSSL's built-in trust store authorizationError: type: object description: >- Node TLS authorization error code/message if not trusted, null otherwise nullable: true required: - commonName - subjectAltName - issuer - expiry - validFrom - isExpired - isNotYetValid - hostnameMatches - selfSigned - keyBits - weakKey - weakSignatureAlgorithm - chain - forwardSecrecy - trusted - authorizationError TlsVulnerabilitiesDto: type: object properties: poodle: type: object description: POODLE (SSLv3 padding oracle) exposure and TLS_FALLBACK_SCSV support drown: type: object description: >- DROWN exposure, simplified to SSLv2 support (full check requires cross-server key reuse analysis) freak: type: object description: FREAK — whether the server accepts EXPORT-grade RSA cipher suites logjam: type: object description: LOGJAM — whether the server negotiates a DHE group under 1024 bits sweet32: type: object description: SWEET32 — whether the server negotiates 3DES/64-bit block ciphers rc4: type: object description: Whether the server accepts RC4 cipher suites nullCipher: type: object description: Whether the server accepts NULL-encryption cipher suites anonymousCipher: type: object description: Whether the server accepts anonymous (unauthenticated) cipher suites crime: type: object description: CRIME — whether the server accepts TLS-level (DEFLATE) compression required: - poodle - drown - freak - logjam - sweet32 - rc4 - nullCipher - anonymousCipher - crime TlsAdvisoryDto: type: object properties: breach: type: object description: >- BREACH is an HTTP-layer attack, not a TLS property — this is advisory only, not a vulnerability verdict secureRenegotiation: type: object description: >- Secure renegotiation (RFC 5746) support signal — absence does not necessarily mean vulnerable ocspStapling: type: object description: Whether the server stapled an OCSP response during the handshake required: - breach - secureRenegotiation - ocspStapling TlsCertificateIssuerDto: type: object properties: country: type: string description: Issuer country example: US organization: type: string description: Issuer organization example: Cloudflare, Inc. commonName: type: string description: Issuer common name example: Cloudflare Inc ECC CA-3 required: - country - organization - commonName TlsCertificateChainDto: type: object properties: length: type: number description: Number of certificates in the chain as presented by the server complete: type: boolean description: >- Whether the chain terminates in a self-signed root (i.e. is not missing an intermediate) certificates: description: Ordered list of certificates from leaf to root type: array items: $ref: '#/components/schemas/TlsCertificateChainEntryDto' required: - length - complete - certificates TlsForwardSecrecyDto: type: object properties: negotiatedCipher: type: object description: Cipher suite negotiated on the primary handshake nullable: true ephemeralKeyType: type: object description: >- Ephemeral key exchange type (e.g. ECDH, DH), null if the cipher does not provide forward secrecy nullable: true ephemeralKeySize: type: object description: Ephemeral key size in bits nullable: true required: - negotiatedCipher - ephemeralKeyType - ephemeralKeySize TlsCertificateChainEntryDto: type: object properties: commonName: type: string description: Common name of this certificate in the chain issuerCommonName: type: string description: Common name of this certificate's issuer fingerprint: type: string description: SHA-1 fingerprint of this certificate required: - commonName - issuerCommonName - fingerprint securitySchemes: x-api-key: type: apiKey in: header name: x-api-key description: API Key required for all endpoints ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.