SSL/TLS Certificate Check (by Domain)

{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain name (e.g. example.com)"
    }
  },
  "additionalProperties": false
}

{
  "type": "object",
  "required": [
    "domain",
    "valid",
    "issuer",
    "subject",
    "subject_alt_names",
    "valid_from",
    "valid_to",
    "days_until_expiry",
    "is_expired",
    "is_expiring_soon",
    "serial_number",
    "fingerprint_sha256",
    "protocol",
    "cipher_name",
    "cipher_version"
  ],
  "properties": {
    "valid": {
      "type": "boolean",
      "description": "Whether the certificate is currently valid (not expired, chain trusted)."
    },
    "domain": {
      "type": "string",
      "description": "The domain that was checked, echoed back."
    },
    "issuer": {
      "type": "string",
      "description": "The certificate authority that issued the certificate, e.g. 'Google Trust Services'."
    },
    "subject": {
      "type": "string",
      "description": "The certificate's subject (commonly the primary domain it was issued for), e.g. '*.google.com'."
    },
    "protocol": {
      "type": "string",
      "description": "The negotiated TLS protocol version, e.g. 'TLSv1.3', 'TLSv1.2'."
    },
    "valid_to": {
      "type": "string",
      "description": "ISO 8601 timestamp the certificate expires."
    },
    "is_expired": {
      "type": "boolean",
      "description": "True once days_until_expiry has passed zero."
    },
    "valid_from": {
      "type": "string",
      "description": "ISO 8601 timestamp the certificate became valid."
    },
    "cipher_name": {
      "type": "string",
      "description": "The negotiated cipher suite's name, e.g. 'TLS_AES_256_GCM_SHA384'."
    },
    "serial_number": {
      "type": "string",
      "description": "The certificate's serial number, as issued by its CA."
    },
    "cipher_version": {
      "type": "string",
      "description": "The protocol version associated with the negotiated cipher suite."
    },
    "is_expiring_soon": {
      "type": "boolean",
      "description": "Whether the certificate is within the endpoint's own expiry-warning window."
    },
    "days_until_expiry": {
      "type": "number",
      "description": "Days remaining until valid_to. Negative when already expired -- observed -4178 on an expired test certificate, so a customer must check the sign, not just treat this as a countdown that stops at zero."
    },
    "subject_alt_names": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Every domain name the certificate covers, including the primary subject. Observed as 2 entries (a single-domain cert) and 68 entries (a multi-domain cert covering many related properties) -- length varies widely by domain, not a fixed count."
    },
    "fingerprint_sha256": {
      "type": "string",
      "description": "SHA-256 fingerprint of the certificate, colon-delimited hex."
    }
  },
  "description": "The certificate record, as returned at routing.responseResultPath ($.output).",
  "additionalProperties": true
}