Overview
An SSL checker API and certificate verification API for expiry monitoring, domain audits and CI checks: send a hostname, get its live SSL certificate back as JSON. SSL Checker opens a real TLS connection to the site, reads the certificate and the chain the server sends, and validates it the way a client does (trusted root, hostname match, expiry), returning the verifier's error code such as CERT_HAS_EXPIRED or UNABLE_TO_VERIFY_LEAF_SIGNATURE when it fails. Alongside issuer, subject, key type, key size and signature algorithm, it reports the TLS protocol and cipher negotiated, the Strict-Transport-Security policy, OCSP stapling and embedded Certificate Transparency SCTs, plus derived checks: days until expiry, an expiring-soon flag and self-signed detection. To see which TLS versions a server still accepts, pair it with TLS Checker.
Live Test Check SSL Certificates Source →
Formula
One function covers the whole catalog: the first argument names the source, the rest are its inputs, and the "field" pair says which single value lands in the cell. Formulas covers the grammar that applies to all of them.
=VERVE("sslchecker", A2, "field", "ca")=VERVE.CALL("sslchecker", A2, "field", "ca")A2 holds the domain you are looking up. Drag the formula down and each row resolves on its own.
With literal values
Nothing has to come from a cell — typed values work the same way.
=VERVE("sslchecker", "ebay.com", "field", "ca")=VERVE.CALL("sslchecker", "ebay.com", "field", "ca")Inputs
Required inputs are positional, in the order below. Everything else is passed as a "name", value pair after them — the same shape as SUMIFS. Premium inputs are accepted on every plan but only take effect on plans that include them.
| Input | Type | Where it goes | Description |
|---|---|---|---|
domainRequired | string | argument 2 (A2) | The domain of the website to check the SSL certificate of domain |
What lands in your sheet
The "field" pair is what makes the formula resolve to one cell. Its value is a dot-path from the table below, so swapping it is how you pull a different value — one formula per column.
Seeing everything at once
Drop the "field" pair and the formula returns the whole response instead: two columns, field name on the left and value on the right, spilling from the cell you typed in.
=VERVE("sslchecker", A2)=VERVE.CALL("sslchecker", A2)The second row's table would land on top of the first's, and every cell after the first reads #REF! (#SPILL! in Excel). Keep one per sheet, or name a field, and leave the cells below and to the right empty.
Response fields
Paths are relative to data. Each one is exactly what the "field" pair accepts, so swapping it is how you pull a different value into a cell. On a plan without a Premium field the cell reads #PREMIUM(field) rather than a value, so a locked field never looks like a real answer.
| Use as "field" | Type | Example cell value | Description |
|---|---|---|---|
subjectPremium | object | {…} | Certificate subject information including country, state, organization, and common name |
subject.CPremium | string | US | Country code of the certificate subject |
subject.STPremium | string | California | State or province of the certificate subject |
subject.OPremium | string | eBay, Inc. | Organization name of the certificate subject |
subject.CNPremium | string | ebay.com | Common name of the certificate subject domain |
issuerPremium | object | {…} | Certificate issuing authority information including country, organization, and common name |
issuer.CPremium | string | GB | Country code of the certificate issuer |
issuer.OPremium | string | Sectigo Limited | Organization name of the certificate issuing authority |
issuer.CNPremium | string | Sectigo Public Server Authentication CA OV R40 | Common name of the certificate authority |
subjectaltnamePremium | string | DNS:ebay.com, DNS:befr.ebay.be, DNS:benl.ebay.be, DNS:cafr.ebay.ca, DNS:e-bay.com, DNS:e-bay.it, DNS… | Alternative subject names included in the certificate |
infoAccessPremium | object | {…} | Information access extension with CA issuers and OCSP URIs |
infoAccess.CA Issuers - URIPremium | array | ["http://crt.sectigo.com/SectigoPublicServerAuthenticationCAOVR40.crt"] | URLs to CA issuer certificates for validation |
infoAccess.OCSP - URIPremium | array | ["http://ocsp.sectigo.com"] | Online Certificate Status Protocol URLs for validation |
ca | boolean | false | Indicates if certificate is a certificate authority |
bits | number | 2048 | Key size in bits representing certificate strength |
valid_from | string | Oct 6 00:00:00 2026 GMT | Certificate validity start date and time in GMT |
valid_to | string | Apr 22 23:59:59 2027 GMT | Certificate validity end date and time in GMT |
serialNumberPremium | string | 19FD41E42C169CF248511D2BEE660A83 | Unique serial number of the SSL certificate |
domain | string | ebay.com | Domain name the certificate was checked for |
isExpired | boolean | false | Whether the certificate is past its valid_to date |
isValid | boolean | true | Whether the current time is within the certificate's validity window (valid_from to valid_to) |
daysUntilExpiryPremium | number | 182 | Whole days until the certificate expires (negative if already expired) |
isExpiringSoonPremium | boolean | false | Whether the certificate expires within the next 30 days |
isSelfSignedPremium | boolean | false | Whether the certificate is self-signed (subject and issuer are the same entity), which browsers do not trust |
protocol | string | TLSv1.3 | TLS version negotiated for this check, e.g. TLSv1.3 |
cipher | string | TLS_AES_128_GCM_SHA256 | Cipher suite negotiated for this check (IANA name where known, e.g. TLS_AES_128_GCM_SHA256) |
isTrusted | boolean | true | Whether the certificate chain verifies to a trusted root CA (Node.js's bundled Mozilla root store) and is within its validity dates. Hostname matching is reported separately in hostnameMatches. Revocation is not checked |
trustError | object | null | The verifier error code when isTrusted is false, e.g. CERT_HAS_EXPIRED, DEPTH_ZERO_SELF_SIGNED_CERT, SELF_SIGNED_CERT_IN_CHAIN or UNABLE_TO_VERIFY_LEAF_SIGNATURE (usually a missing intermediate); null when trusted |
hostnameMatches | boolean | true | Whether the certificate's subject alternative names (or common name, if it has none) cover the checked domain |
chainPremium | array[4] | The certificate chain from the site certificate upward: what the server sent, plus the trust-store root when one was found | |
chain.0.subjectPremium | string | ebay.com | Common name (or organization) of this certificate |
chain.0.issuerPremium | string | Sectigo Public Server Authentication CA OV R40 | Common name (or organization) of the certificate that signed it |
chain.0.validToPremium | string | Apr 22 23:59:59 2027 GMT | Expiry date and time of this certificate in GMT |
chain.0.isCAPremium | boolean | false | Whether this certificate is a certificate authority |
keyType | string | RSA | Public key algorithm of the certificate: RSA, EC, Ed25519, Ed448, RSA-PSS or DSA |
signatureAlgorithm | string | sha256WithRSAEncryption | Algorithm the issuer signed the certificate with, e.g. sha256WithRSAEncryption or ecdsa-with-SHA256 (dotted OID if unrecognised) |
hasEmbeddedSCTs | boolean | true | Whether the certificate embeds Certificate Transparency SCTs (RFC 6962 extension). SCTs delivered by TLS extension or OCSP instead are not detected |
ocspStapled | boolean | true | Whether the server stapled an OCSP response to the handshake |
hsts | object | {…} | Strict-Transport-Security policy from the response to GET /; null if the server completed the handshake but returned no HTTP response |
hsts.present | boolean | true | Whether the response carried a Strict-Transport-Security header |
hsts.maxAge | number | 31536000 | max-age in seconds (0 means HSTS is switched off); null if absent |
hsts.includeSubDomains | boolean | false | Whether the policy includes the includeSubDomains directive |
hsts.preload | boolean | false | Whether the policy includes the preload directive |
Filling a whole column
Both platforms make one batched call for a column rather than one request per cell, and both cost the same — 10 credits per row looked up. How you write it differs, because the two runtimes batch at different points.
=VERVE("sslchecker", A2:A100, "field", "ca")In Google Sheets, give the arguments ranges and the answers spill down from the cell you typed in. Custom functions there run synchronously and in isolation, so dragged cells cannot be coalesced — the range form is how a column becomes one call. The "field" pair is required here: a per-row two-column table has nowhere to spill. Use a full column per input (A2:A100, not A2) — a single-cell reference is read as row 1 only and the rest of the column comes back blank.
In Excel, type the formula once and fill down — no range form and none needed, because its runtime is asynchronous and the add-in coalesces the calls a fill produces into a single batched request. Do not hand VERVE.CALL a range: Excel flattens it into positional arguments, so A2:A100 arrives as a hundred separate arguments and the cell reads #ERR rather than filling.
Either way, column A holds your domain values and the answers land beside them, one row each, blank rows skipped.
When a cell doesn't fill
A failed lookup returns readable text starting with #ERR rather than a spreadsheet error, because Excel cannot show a custom message on a real error — you would get a bare #VALUE! with no reason. The trade-off is that IFERROR() will not catch it; test with LEFT(cell, 4) = "#ERR" instead. Error handling covers the rest.
| Cell reads | What happened |
|---|---|
#ERR Not connected | No API key saved. Open the side panel and connect your account. |
#ERR Replace <name> with a cell or value | A preview formula was copied as-is. Swap the placeholder for a cell reference. |
#ERR No "x" in sslchecker | An option name this source does not take. The message lists the ones it does. |
#ERR No data point "…" | The "field" path is not in the response. Check it against the table above. |
#PREMIUM(field) | The field exists but your plan does not include it. |
#ERR Out of credits | The cycle's credits are spent. Usage resets on your billing date. |
Before the formula works
The add-in reads the API key you saved once in the side panel — the key never goes in the formula, so a shared sheet does not leak it and a collaborator without access simply sees the last calculated values.
- Install the add-in for Google Sheets or Excel.
- Open the side panel and sign in, or paste a key from your dashboard.
- Type the formula above into any cell.
Use cases
- SSL Monitoring and Expiry Alerts
- DevOps teams check their domains daily from a cron job or uptime monitor, alerting on certificates close to expiry, failed chain validation or a hostname mismatch before browsers start showing warnings.
- Customer Domain Audits
- When clients point custom hostnames to a SaaS platform, automated onboarding scripts verify validity status and key strength before activating traffic.
- Certificate Chain and Key Audits
- Security teams sweep corporate web properties for setups that need fixing: certificates that fail validation, servers missing an intermediate, RSA keys under 2048 bits, SHA-1 signatures or no HSTS policy.
- Partner Domain Verification
- To prevent broken checkouts, e-commerce marketplaces inspect partner payment gateways to confirm validity windows before routing shopper transactions.
Other ways to use Check SSL Certificates
Set up Check SSL Certificates on VerveSheets, or reach the same source a different way. Your VerveSheets account and credits work on all of them — one key, one balance.
Related
More in Domain Data: