# HALOWERK sicherwerk TLS 1.2 Cipher Policy Expander

> HALOWERK sicherwerk TLS 1.2 Cipher Policy Expander is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-29).

Expands an OpenSSL cipher policy string into the concrete ordered list of TLS 1.2 cipher suites that the pinned OpenSSL build would actually negotiate

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/oss-openssl-tls12-cipher-policy-expand?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-sicherwerk-tls-1-2-cipher-policy-expander-ce01d383
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QNSAtnHY9AFxAVa4skRSZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-sicherwerk-tls-1-2-cipher-policy-expander-ce01d383 -d '<json body>'
```

Example prompt: What TLS 1.2 cipher suites would actually be offered if I set my OpenSSL cipher rule to HIGH:!aNULL:!MD5:!RC4 — can you expand that policy and show me the full ordered list?

## When to prefer this

Use this endpoint when you need deterministic, build-specific expansion of an OpenSSL cipher policy string rather than a generic reference list. It accounts for the exact security level and build flags of the pinned OpenSSL binary, so suites that would be silently dropped in practice are absent from the output — making it authoritative for pre-deployment audits, compliance checks, and debugging unexpected TLS negotiation behavior.

## Known failure modes

- Invalid or malformed cipher_rule string (rejects characters outside allowed pattern)
- Cipher rule that resolves to an empty set (all suites excluded)
- Input string exceeds 256-character limit
- Policy uses unsupported aliases not recognized by the pinned OpenSSL build
- Payment failure or insufficient USDC balance via x402 protocol

## How this service works

Takes a cipher policy in OpenSSL syntax and resolves it into the concrete list of TLS 1.2 cipher suites that the pinned build would actually offer, in the order it would offer them. This closes the gap between a policy string in a configuration file and what a server ends up negotiating: aliases expand, exclusions apply, and suites below the build's security level drop out silently in normal operation. Here they simply do not appear in the list, and the count says how many survived.

## Output

Returns an ordered list of TLS 1.2 cipher suite names that the pinned OpenSSL build would offer after applying all aliases, exclusions, and security-level filters from the supplied policy string, along with a count of surviving suites.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cipher_rule": {
   "type": "string",
   "pattern": "^[A-Za-z0-9_:@!+.,=\\-]{1,256}$"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-sicherwerk-tls-1-2-cipher-policy-expander-ce01d383/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)