# HALOWERK sicherwerk CSR Self-Signature Audit

> HALOWERK sicherwerk CSR Self-Signature Audit is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-29).

Validates a PEM-encoded certificate signing request by verifying its self-signature and parsing all requested fields, extensions, and public key parameters via a pinned OpenSSL build.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/oss-openssl-csr-self-signature-audit?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-sicherwerk-csr-self-signature-audit-d977aa32
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_A46It-3RXhzBOQ4IfZPo9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-sicherwerk-csr-self-signature-audit-d977aa32 -d '<json body>'
```

Example prompt: Can you check this CSR to confirm its self-signature is valid and tell me exactly what subject, public key type, and extensions it's requesting? Here's the PEM: -----BEGIN CERTIFICATE REQUEST----- MIIBIjANBgkq...

## When to prefer this

Choose this endpoint when you need a deterministic, OpenSSL-backed audit of a PKCS#10 CSR before a registration authority signs it — particularly when you need both signature validity and a trusted parsed representation of the subject, key, and extensions for policy enforcement. Prefer this over client-side parsing when you cannot trust the applicant's own tooling or representation of the request.

## Known failure modes

- Malformed or non-PEM input returns a parse error
- CSR with invalid self-signature returns a failed verification result
- CSR exceeding 262144 bytes is rejected
- Non-PKCS#10 PEM blocks (e.g. a certificate instead of a CSR) cause a parsing failure
- Payment failure (x402) blocks the request before processing

## How this service works

Runs the pinned OpenSSL build against a submitted certificate request and answers two questions a registration authority has to settle before it signs anything: does the request carry a valid self-signature over its own body, and what exactly is being requested. The reply names the subject, the public key parameters and every requested extension as OpenSSL parses them, so a policy check compares against the parsed request rather than the text an applicant supplied.

## Output

Returns whether the CSR self-signature is cryptographically valid, plus OpenSSL-parsed details including the subject distinguished name, public key algorithm and parameters, and all requested certificate extensions — giving a registration authority a trustworthy parsed view of what the applicant is requesting.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "csr_pem": {
   "type": "string",
   "maxLength": 262144,
   "minLength": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-sicherwerk-csr-self-signature-audit-d977aa32/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)