{"uid":"cap_R0m8ZhsC4pfkDDIAcqUYw","slug":"halowerk-sicherwerk-x-509-certificate-purpose-evaluator-766b3166","name":"HALOWERK sicherwerk X.509 Certificate Purpose Evaluator","description":"Reads the constraints inside a single certificate — basic constraints, key usage, extended key usage — and reports, per role, whether the certificate permits being used that way under the pinned OpenSSL build's rules. Roles covered are TLS client, TLS server, S/MIME signing and encryption, and timestamp signing. This answers the frequent confusion where a certificate is deployed for a purpose its own extensions forbid, and the failure only shows up as an opaque handshake error later.","url":"https://sicher.halowerk.com/v1/oss-openssl-x509-purpose-evaluate?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"certificate_pem":{"type":"string","maxLength":262144,"minLength":1}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_5kywDPLeJeddzzyDselsz","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Evaluates a PEM-encoded X.509 certificate's extension constraints against OpenSSL's rules to determine which roles (TLS client/server, S/MIME signing/encryption, timestamp signing) the certificate is actually permitted to perform.","exampleAgentPrompt":"I deployed this certificate for TLS but keep getting opaque handshake failures — can you check whether its key usage and extended key usage extensions actually permit TLS server use? Here's the PEM: -----BEGIN CERTIFICATE-----...","exampleUseCases":[{"title":"Debugging TLS handshake certificate errors","prompt":"My nginx server keeps throwing TLS handshake errors and I suspect the certificate might not have the right key usage set for server use — can you run this PEM through the OpenSSL purpose checker to see if it's actually allowed to act as a TLS server certificate?"},{"title":"Pre-deployment S/MIME certificate audit","prompt":"Before I configure this certificate for S/MIME email signing and encryption in our mail client, can you verify whether its extensions actually permit both signing and encryption roles under OpenSSL's rules? Here's the PEM."},{"title":"Timestamp authority certificate validation","prompt":"I need to use this certificate for RFC 3161 timestamp signing but I'm not sure if its extended key usage allows that — can you check the certificate extensions and tell me if it's permitted for timestamp signing?"}],"resultDescription":"A structured report indicating, per role (TLS client, TLS server, S/MIME signing, S/MIME encryption, timestamp signing), whether the submitted certificate's extensions permit that role under the pinned OpenSSL build's evaluation rules — helping pinpoint mismatches between intended deployment and what the certificate's own constraints allow.","failureModes":["Invalid or malformed PEM input returns a parse error","Certificate with no extensions may produce indeterminate results for some roles","Expired certificates may still be evaluated for purpose but expiry is a separate concern","Oversized PEM exceeding 262144 characters will be rejected","Empty certificate_pem field returns a validation error"],"whenToPreferThis":"Use this endpoint when you need to understand exactly which operational roles an X.509 certificate's own extension constraints permit, especially when diagnosing opaque TLS handshake failures or S/MIME configuration errors caused by key usage mismatches. Prefer this over generic certificate parsers when you specifically need OpenSSL-rules-based purpose evaluation rather than raw extension display.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T00:33:33.817Z","isFirstParty":false,"canonicalSlug":"halowerk-sicherwerk-x-509-certificate-purpose-evaluator-766b3166"}