X.509 certificate inspection from PEM
Takes a PEM-encoded X.509 certificate and returns its fields (subject, issuer, serial, validity window, SANs, key usage, EKU, basic constraints, signature algorithm, public key algorithm and bit size) plus a fail-on-issue audit: expired or not-yet-valid, hostname/SAN mismatch per RFC 6125 §6.4.3 wildcards, weak signature (SHA-1), short RSA (<2048), serverAuth without SAN (CABF BR 7.1.4.2.1). Decodes DER with an inline ASN.1 walker, so it runs on Cloudflare Workers with no external library.
What you get
Expired-cert outages are preventable; this is the one-call audit that CI can run on every new PEM a deploy pins or a secret store receives.
Call it
Send the JSON body below to https://agents.writerslogic.com/api/v1/x509-inspect. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.
curl -i -X POST https://agents.writerslogic.com/api/v1/x509-inspect \
-H 'content-type: application/json' \
-d '{"pem":"-----BEGIN CERTIFICATE-----\nMIIB...=\n-----END CERTIFICATE-----","hostname":"example.com"}'
Input
| Field | Type | Required | Description |
|---|---|---|---|
pem | string; length 0..200000 | yes | A PEM block beginning with '-----BEGIN CERTIFICATE-----'. |
hostname | string; length 0..255 | no | Optional hostname to check against the certificate's SANs. |
nowIso | string; length 0..40 | no | Override 'now' for deterministic tests. |
intermediates | array<string>; max 10 items | no | Intermediate certs (PEM) between leaf and anchor. |
trustAnchors | array<string>; max 20 items | no | Trust anchors (PEM). When present, chain cryptographic verification runs. |
maxChainDepth | integer | no | Chain depth cap (default 8). |
Example request body
{
"pem": "-----BEGIN CERTIFICATE-----\nMIIB...=\n-----END CERTIFICATE-----",
"hostname": "example.com"
}
Result
The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.
| Field | Type | Required | Description |
|---|---|---|---|
status | string; one of "pass", "fail", "unknown", "unsupported" | no | pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass. |
valid | boolean | no | |
subject | string | no | |
issuer | string | no | |
serial | string | no | |
notBefore | string | no | |
notAfter | string | no | |
subjectAltNames | array<string> | no | |
keyUsage | array<string> | no | |
extendedKeyUsage | array<string> | no | |
signatureAlgorithm | string | no | |
publicKey | object | no | |
basicConstraints | object | no | |
hostnameMatch | boolean | no | |
daysUntilExpiry | integer | no | |
signatureAlgorithmOid | string | no | |
publicKeyCurve | string | no | |
chain | object | no | Present when trustAnchors is supplied: valid, depth, subject-path and failure reason. |
witnesses | array<object> | no | |
versions | object | no | Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile). |
limits | array<string> | no | |
deterministic | boolean | no | Always true: pure code, no model. |
Pay and connect
Available through: x402 (USDC on Base), MCP. MCP clients reach it through the identifier-text-kit package.
Machine-readable
- This agent as JSON (schemas, example, OpenAPI operation)
- Free signed sample response
- OpenAPI 3.1 · Catalog · Index of every agent