# CertH

> TLS certificate health monitoring & public SSL grade leaderboards. Pure Cloudflare Workers implementation.

## Pages
- [Home / instant scan](https://certh.csr.plus/): scan any domain without signup; results persist under throttling
- [SSL Leaderboard](https://certh.csr.plus/leaderboard): global Top sites ranked by TLS health, filters by grade/industry/region
- [Leaderboard sub-boards](https://certh.csr.plus/leaderboard): /leaderboard/improvers (biggest gains), /leaderboard/new (recently indexed), /leaderboard/{grade} (a-plus … f), /leaderboard/{industry} (banking, ecommerce, social, government, news, streaming, gaming, crypto, healthcare, education, hosting-cloud, saas-tech), /leaderboard/{region} (us, uk, de, jp, in, br, fr, ca, au, sg, nl, se, kr, it, es, ch, tw, hk, ru, mx)
- [Badges](https://certh.csr.plus/badges): embeddable SVG badges in four styles (card — issuer info, card-trend — 30-day trend chart, cupertino, brand)
- [API overview](https://certh.csr.plus/api) and [API reference](https://certh.csr.plus/api/doc): endpoints, params, rate limits, error codes
- Domain pages: https://certh.csr.plus/domain/{domain} — score ring, score-change insights (why the score moved), 90-day trend, history, CT discoveries, related certificates
- [Admin](https://certh.csr.plus/admin): requires admin account (noindex)
- [About](https://certh.csr.plus/about) · [Privacy Policy](https://certh.csr.plus/privacy) · [Terms](https://certh.csr.plus/terms) · [Contact](https://certh.csr.plus/contact): certh@csr.plus
- Languages: en, zh, zh-tw, ja, ko, de, fr, it, vi, ru, es, th, id, ar, hi, tr, pt (17 total)
- [XML sitemap](https://certh.csr.plus/sitemap.xml): sitemap index — /sitemap-core.xml (17-language core pages + guides) and /sitemap-domains-1..4.xml (4,000 domain pages)

## Guides
- [All guides](https://certh.csr.plus/guides): also available in 15 languages at /{lang}/guides (zh, ja, ko, de, fr, it, es, pt, ru, vi, th, id, ar, hi, tr)
- [How to get an A+ SSL grade](https://certh.csr.plus/guides/how-to-get-an-a-plus-ssl-grade): the exact TLS settings CertH and SSL Labs check, copy-paste nginx/Apache config, and the mistakes that keep a site at A
- [TLS 1.3](https://certh.csr.plus/guides/tls-1-3): what the protocol removes, why it is required for A+, and how to verify the handshake
- [HSTS](https://certh.csr.plus/guides/hsts): what max-age really controls, when includeSubDomains and preload break things, staged rollout
- [OCSP stapling](https://certh.csr.plus/guides/ocsp-stapling): the privacy and latency benefit, enabling and verifying it, why A+ does not require it
- [Why a valid certificate can still score F](https://certh.csr.plus/guides/valid-certificate-low-score): six TLS configuration failures and how to diagnose each
- [CertH grade vs SSL Labs](https://certh.csr.plus/guides/ssl-grade-vs-ssl-labs): how the two scoring models differ and when to trust which

## Public API (no auth)
- GET https://certh.csr.plus/api/plans
- POST https://certh.csr.plus/api/scan  body: {"domain":"example.com"} — instant scan; persists under throttling (first scan seeds the record, repeats append history, max 1 snapshot per domain per hour)
- GET https://certh.csr.plus/api/public/domains/{domain}/history?days=N — score history: 45 days free; API Key unlocks Pro 90 / Agency 365
- GET https://certh.csr.plus/api/leaderboard?page=1&pageSize=50&sort=score|expiring&grade=A%2B&q=stripe
- GET https://certh.csr.plus/api/domain/{domain} — latest snapshot
- GET https://certh.csr.plus/badge/{domain}.svg?style=card|card-trend|cupertino|brand&theme=light|dark&score=1&lang=zh|en — edge-cached 1h (card = issuer info, the default; card-trend = 30-day trend line)

## Authenticated API
- Session Cookie (OAuth sign-in) or ?api_key=: GET https://certh.csr.plus/api/me, GET/POST/DELETE https://certh.csr.plus/api/domains, GET https://certh.csr.plus/api/domains/{domain}/history?days=N (private history), GET https://certh.csr.plus/api/discover, GET/POST/DELETE https://certh.csr.plus/api/alert-rules
- API Key (x-api-key header, ch_ prefix): unlocks longer history on the public history endpoint; also used by POST https://certh.csr.plus/api/ingest (self-hosted scan reporting, advanced plans)
- Admin (ADMIN_EMAILS): GET/PUT https://certh.csr.plus/api/admin/users, GET https://certh.csr.plus/api/admin/stats, POST https://certh.csr.plus/api/admin/scan-domain|reseed|sync-tags

## Data policy
- Leaderboard (system) snapshots retained >= 365 days; the free API tier truncates history to 45 days
- Grades follow SSL Labs semantics (A+ … F, plus T/M trust/mismatch states documented on-site)
- Honest-mode badges cache max 1h; leaderboard snapshots update daily