{"id":"x509-inspect","title":"X.509 certificate inspection from PEM","description":"Takes a PEM-encoded X.509 certificate and returns its fields (subject, issuer, serial, validity window, SANs, key usage, EKU, basic constraints, signature algorithm, public key algorithm and bit size) plus a fail-on-issue audit: expired or not-yet-valid, hostname/SAN mismatch per RFC 6125 §6.4.3 wildcards, weak signature (SHA-1), short RSA (<2048), serverAuth without SAN (CABF BR 7.1.4.2.1). Decodes DER with an inline ASN.1 walker, so it runs on Cloudflare Workers with no external library.","roi":"Expired-cert outages are preventable; this is the one-call audit that CI can run on every new PEM a deploy pins or a secret store receives.","audience":"business","package":"identifier-text-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/x509-inspect","path":"/api/v1/x509-inspect","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["pem"],"properties":{"pem":{"type":"string","maxLength":200000,"description":"A PEM block beginning with '-----BEGIN CERTIFICATE-----'."},"hostname":{"type":"string","maxLength":255,"description":"Optional hostname to check against the certificate's SANs."},"nowIso":{"type":"string","maxLength":40,"description":"Override 'now' for deterministic tests."},"intermediates":{"type":"array","items":{"type":"string"},"maxItems":10,"description":"Intermediate certs (PEM) between leaf and anchor."},"trustAnchors":{"type":"array","items":{"type":"string"},"maxItems":20,"description":"Trust anchors (PEM). When present, chain cryptographic verification runs."},"maxChainDepth":{"type":"integer","description":"Chain depth cap (default 8)."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"valid":{"type":"boolean"},"subject":{"type":"string"},"issuer":{"type":"string"},"serial":{"type":"string"},"notBefore":{"type":"string"},"notAfter":{"type":"string"},"subjectAltNames":{"type":"array","items":{"type":"string"}},"keyUsage":{"type":"array","items":{"type":"string"}},"extendedKeyUsage":{"type":"array","items":{"type":"string"}},"signatureAlgorithm":{"type":"string"},"publicKey":{"type":"object","properties":{"algorithm":{"type":"string"},"bits":{"type":"integer"}}},"basicConstraints":{"type":"object","properties":{"ca":{"type":"boolean"},"pathLenConstraint":{"type":"integer"}}},"hostnameMatch":{"type":"boolean"},"daysUntilExpiry":{"type":"integer"},"signatureAlgorithmOid":{"type":"string"},"publicKeyCurve":{"type":"string"},"chain":{"type":"object","description":"Present when trustAnchors is supplied: valid, depth, subject-path and failure reason."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"valid":{"type":"boolean"},"subject":{"type":"string"},"issuer":{"type":"string"},"serial":{"type":"string"},"notBefore":{"type":"string"},"notAfter":{"type":"string"},"subjectAltNames":{"type":"array","items":{"type":"string"}},"keyUsage":{"type":"array","items":{"type":"string"}},"extendedKeyUsage":{"type":"array","items":{"type":"string"}},"signatureAlgorithm":{"type":"string"},"publicKey":{"type":"object","properties":{"algorithm":{"type":"string"},"bits":{"type":"integer"}}},"basicConstraints":{"type":"object","properties":{"ca":{"type":"boolean"},"pathLenConstraint":{"type":"integer"}}},"hostnameMatch":{"type":"boolean"},"daysUntilExpiry":{"type":"integer"},"signatureAlgorithmOid":{"type":"string"},"publicKeyCurve":{"type":"string"},"chain":{"type":"object","description":"Present when trustAnchors is supplied: valid, depth, subject-path and failure reason."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"pem":"-----BEGIN CERTIFICATE-----\nMIIB...=\n-----END CERTIFICATE-----","hostname":"example.com"},"openapiOperation":{"operationId":"x509_inspect","summary":"X.509 certificate inspection from PEM","description":"Takes a PEM-encoded X.509 certificate and returns its fields (subject, issuer, serial, validity window, SANs, key usage, EKU, basic constraints, signature algorithm, public key algorithm and bit size) plus a fail-on-issue audit: expired or not-yet-valid, hostname/SAN mismatch per RFC 6125 §6.4.3 wildcards, weak signature (SHA-1), short RSA (<2048), serverAuth without SAN (CABF BR 7.1.4.2.1). Decodes DER with an inline ASN.1 walker, so it runs on Cloudflare Workers with no external library.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"business","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/x509-inspect","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["pem"],"properties":{"pem":{"type":"string","maxLength":200000,"description":"A PEM block beginning with '-----BEGIN CERTIFICATE-----'."},"hostname":{"type":"string","maxLength":255,"description":"Optional hostname to check against the certificate's SANs."},"nowIso":{"type":"string","maxLength":40,"description":"Override 'now' for deterministic tests."},"intermediates":{"type":"array","items":{"type":"string"},"maxItems":10,"description":"Intermediate certs (PEM) between leaf and anchor."},"trustAnchors":{"type":"array","items":{"type":"string"},"maxItems":20,"description":"Trust anchors (PEM). When present, chain cryptographic verification runs."},"maxChainDepth":{"type":"integer","description":"Chain depth cap (default 8)."}}},"example":{"pem":"-----BEGIN CERTIFICATE-----\nMIIB...=\n-----END CERTIFICATE-----","hostname":"example.com"}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"valid":{"type":"boolean"},"subject":{"type":"string"},"issuer":{"type":"string"},"serial":{"type":"string"},"notBefore":{"type":"string"},"notAfter":{"type":"string"},"subjectAltNames":{"type":"array","items":{"type":"string"}},"keyUsage":{"type":"array","items":{"type":"string"}},"extendedKeyUsage":{"type":"array","items":{"type":"string"}},"signatureAlgorithm":{"type":"string"},"publicKey":{"type":"object","properties":{"algorithm":{"type":"string"},"bits":{"type":"integer"}}},"basicConstraints":{"type":"object","properties":{"ca":{"type":"boolean"},"pathLenConstraint":{"type":"integer"}}},"hostnameMatch":{"type":"boolean"},"daysUntilExpiry":{"type":"integer"},"signatureAlgorithmOid":{"type":"string"},"publicKeyCurve":{"type":"string"},"chain":{"type":"object","description":"Present when trustAnchors is supplied: valid, depth, subject-path and failure reason."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/x509-inspect/","docsJson":"https://agents.writerslogic.com/docs/x509-inspect.json","sample":"https://agents.writerslogic.com/api/v1/samples/x509-inspect","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}