{"uid":"cap_KWV_VTPTjaROTcVJezXkY","slug":"lookproof-csr-decode-1635db55","name":"Lookproof CSR Decode","description":"Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.","url":"https://api.lookproof.dev/v1/tls/csr-decode?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"pem":{"type":"string","title":"Pem","maxLength":16384,"minLength":1}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_e0lT9JNwQrZTgJF9Od4-D","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Parses and validates a PEM-encoded PKCS#10 certificate signing request, returning subject, SANs, key type/size, and signature validity — fully offline.","exampleAgentPrompt":"Can you decode this CSR and tell me whether its signature is valid, what key type and size it uses, and which DNS names are in it? -----BEGIN CERTIFICATE REQUEST----- MIICvDCCAaQCAQAwdzEL...-----END CERTIFICATE REQUEST-----","exampleUseCases":[{"title":"Pre-submission CSR sanity check","prompt":"Before I send this CSR to Let's Encrypt, can you decode it and confirm the DNS names look right, the key is at least 2048-bit RSA, and the signature is valid? Here's the PEM: -----BEGIN CERTIFICATE REQUEST----- MIICvDCCAaQ...-----END CERTIFICATE REQUEST-----"},{"title":"Automated pipeline CSR validation","prompt":"I've got a CSR generated by our deployment script and I need to verify the signature matches the key and that the subject CN is 'api.example.com' — can you parse this PEM and check? -----BEGIN CERTIFICATE REQUEST----- MIICijCCAXI...-----END CERTIFICATE REQUEST-----"},{"title":"Security audit of vendor-supplied CSR","prompt":"A vendor sent us this CSR to sign and I want to make sure it's using ECDSA P-256 and only contains SANs for their subdomain — can you decode it and tell me what's inside? -----BEGIN CERTIFICATE REQUEST----- MIHoMIGQAgEA...-----END CERTIFICATE REQUEST-----"}],"resultDescription":"A structured JSON object containing: the subject distinguished name fields, all DNS and IP subject alternative names, the public key type (e.g. RSA, ECDSA) and size in bits, the signature algorithm (e.g. sha256WithRSAEncryption), and a boolean indicating whether the CSR's self-signature is cryptographically valid. Email addresses are intentionally omitted. Processing is done offline — the CSR is never submitted to any CA.","failureModes":["Malformed or truncated PEM returns a 4xx error with a parse failure message","PEM block is present but contains a certificate or private key instead of a CERTIFICATE REQUEST — returns error indicating wrong PEM type","CSR exceeds 16 384-character limit — returns 422 validation error","Missing or empty pem field — returns 422 unprocessable entity","Valid PEM but internally corrupted ASN.1 structure — returns decode error"],"whenToPreferThis":"Use this endpoint when an AI agent needs to inspect or validate a CSR before forwarding it to a certificate authority, when a pipeline must assert key strength or algorithm compliance, or when a security reviewer wants to audit subject and SAN fields without standing up OpenSSL locally. Prefer this over generic TLS-check endpoints (which probe live servers) because it works entirely offline from the raw PEM text, requires no domain access, and is deterministic. Best when the agent already has the CSR PEM in hand.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:35.784Z","isFirstParty":false,"canonicalSlug":"lookproof-csr-decode-1635db55"}