The Trustico® SSL Certificate Tools Application Programming Interface (API) puts the tools hosted at tools.trustico.com behind a set of endpoints your own scripts and systems can call. Anything the tools do in a browser can be done programmatically instead.
It is free, open, and requires no key or account of any kind. That makes it suitable for build pipelines, monitoring jobs, hosting control panels, and anywhere a check needs to happen without a person present.
Every endpoint accepts and returns JavaScript Object Notation (JSON) over Hypertext Transfer Protocol Secure (HTTPS). The reference documentation carries the full request and response detail for each one, with working examples in three languages. Read The SSL Certificate Tools API Documentation 🔗
Access and Limits
There is no authentication. No key is issued, no header is required, and no account needs to exist before the first request. The base address is the tools domain followed by the api path, and every documented endpoint accepts a POST request.
Requests are limited to 100 per minute. A request that exceeds the limit is refused rather than queued, so an integration making many calls should pace them and handle the refusal rather than assume every call will succeed.
Note : Because there is no key, the limit applies to the source of the requests rather than to an identified account. Shared infrastructure calling from a single address shares the same allowance.
The tools and this Application Programming Interface (API) are provided as a convenience. They are not required in order to obtain or install any SSL Certificate that Trustico® offers.
Certificate Signing Request (CSR) Endpoints
Two endpoints cover the Certificate Signing Request (CSR). One generates a new request together with its Private Key, taking the common name and the organization details along with the key size, key type and digest algorithm you want.
The other decodes an existing Certificate Signing Request (CSR) and returns what is inside it, including the subject fields, the public key algorithm and size, and the signature algorithm.
Decoding before submission is the more valuable of the two in practice. Confirming the common name and organization details are correct before an order is placed avoids a reissue later to fix a typographical error. Learn About Certificate Signing Requests (CSR) 🔗
Warning : A Private Key returned by the generation endpoint is the only copy. It is not retained by Trustico® and cannot be recovered, so capture and store it securely at the moment it is returned.
Where a Private Key is lost after an SSL Certificate has been issued, a reissue against a fresh Certificate Signing Request (CSR) is the remedy, and it carries no charge within the license period.
SSL Certificate Chain Analysis Endpoints
Two endpoints analyze an SSL Certificate chain. The first takes an SSL Certificate you supply and works through the trust path, identifying the end entity, intermediate and root positions, checking expiry dates, and validating signatures.
The second connects to a live address over Hypertext Transfer Protocol Secure (HTTPS) and retrieves the chain that server actually presents, then performs the same analysis. It reports what a browser sees rather than what you believe is installed.
That distinction is what makes the second endpoint useful as a monitoring job. Running it against production on a schedule catches a missing intermediate or an approaching expiry date before a visitor encounters a warning. Learn About Intermediate Certificates 🔗
SSL Certificate and Private Key Matching
One endpoint confirms that an SSL Certificate and a Private Key form a matching pair, by comparing the cryptographic properties of each rather than by attempting an installation.
Running this check before deployment is worth the single call it costs. A mismatch discovered on the server usually means a failed restart and an outage, whereas a mismatch discovered beforehand means finding the right key. Learn About Installing an SSL Certificate 🔗
PFX (PKCS#12) Conversion
One endpoint bundles an SSL Certificate, its Private Key and any intermediates into the PFX format, which is what Windows and several appliance platforms expect.
A password may be supplied to encrypt the bundle, and where one is given the encryption may be chosen. The legacy option exists for older platforms that cannot read modern encryption, and the modern option should be preferred wherever the target platform supports it.
Where no password is supplied the bundle is created without encryption, which is convenient for immediate use but should not be how a Private Key is stored or transmitted.
Certification Authority Authorization (CAA) Endpoints
Three endpoints cover Certification Authority Authorization (CAA), the Domain Name System (DNS) records that state which Certificate Authorities (CA) may issue for a domain name.
The first generates the records that authorize Sectigo® to issue, letting you choose which tags to include for standard SSL Certificates, Wildcard SSL Certificates, S/MIME E-Mail Certificates, and violation reporting to an e-mail address.
The second validates the syntax of a single record before you publish it, parsing the domain, flags, tag and value. Catching a malformed record beforehand matters, because a broken record blocks issuance rather than being ignored.
The third looks up the records currently published for any domain name and reports which Certificate Authorities (CA) are authorized. Where no records are found, any Certificate Authority (CA) may issue. Learn About Certification Authority Authorization (CAA) Records 🔗
Domain Control Validation (DCV) Checking
One endpoint checks whether the resource required for Domain Control Validation (DCV) is correctly in place, covering the CNAME record, the TXT record, and the file served over either Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS).
The behavior differs between methods in a way worth knowing. The two Domain Name System (DNS) record checks match without regard to letter case, while the two file checks are case sensitive.
Checking from outside your own network before the Certificate Authority (CA) attempts validation is the point of this endpoint. A record that resolves internally but not publicly is a common cause of validation that never completes. Learn About Validation Reuse Periods 🔗
Top Level Domain (TLD) Verification
One endpoint reports whether a domain name uses a real, publicly registrable Top Level Domain (TLD), returning the registrable base domain, the public suffix, and whether a wildcard prefix was supplied.
It behaves differently from every other endpoint by design. An unusable domain name is not refused with an error, and the request always succeeds with the verdict carried in the response, which makes it usable as a straightforward lookup.
This is the same check every Trustico® tool applies internally, so calling it first is a cheap way to reject an obvious mistake before it reaches an order form or a validation attempt.
Domain Name System (DNS) Stamp Endpoints
Two endpoints generate and decode Domain Name System (DNS) stamps, the compact encoding that carries the full configuration of a Domain Name System (DNS) resolver in a single shareable string.
Plain Domain Name System (DNS) is supported, along with the encrypted Domain Name System (DNS) protocols carried over Hypertext Transfer Protocol Secure (HTTPS), Transport Layer Security (TLS) and QUIC.
The DNSCrypt protocol and its relay type are supported, as are the Oblivious Domain Name System (DNS) target and relay types.
These sit slightly apart from the SSL Certificate tools, and are included because resolver configuration is frequently what stands between a correct validation record and a validation that will not complete.
Reading the Reference Documentation
The documentation lists every endpoint with its full request body, a complete response example, and ready to run examples using cURL, JavaScript and Python.
Each tool is also available as a page you can use directly in a browser, which is often the quicker route when a single check is all that is needed.
Ordering Your SSL Certificate
These endpoints prepare, check and troubleshoot. None of them issues an SSL Certificate, because issuance is performed by the Certificate Authority (CA) against a validated order.
Once a Certificate Signing Request (CSR) has been generated and decoded to confirm its contents, the order itself is placed in the Trustico® store. Explore Every SSL Certificate Available 🔗
