# HALOWERK sicherwerk X.509 Certificate Purpose Evaluator

> HALOWERK sicherwerk X.509 Certificate Purpose Evaluator is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-29).

Evaluates a PEM-encoded X.509 certificate's extension constraints against OpenSSL's rules to determine which roles (TLS client/server, S/MIME signing/encryption, timestamp signing) the certificate is actually permitted to perform.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/oss-openssl-x509-purpose-evaluate?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-sicherwerk-x-509-certificate-purpose-evaluator-766b3166
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_R0m8ZhsC4pfkDDIAcqUYw

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-sicherwerk-x-509-certificate-purpose-evaluator-766b3166 -d '<json body>'
```

Example prompt: I deployed this certificate for TLS but keep getting opaque handshake failures — can you check whether its key usage and extended key usage extensions actually permit TLS server use? Here's the PEM: -----BEGIN CERTIFICATE-----...

## When to prefer this

Use this endpoint when you need to understand exactly which operational roles an X.509 certificate's own extension constraints permit, especially when diagnosing opaque TLS handshake failures or S/MIME configuration errors caused by key usage mismatches. Prefer this over generic certificate parsers when you specifically need OpenSSL-rules-based purpose evaluation rather than raw extension display.

## Known failure modes

- Invalid or malformed PEM input returns a parse error
- Certificate with no extensions may produce indeterminate results for some roles
- Expired certificates may still be evaluated for purpose but expiry is a separate concern
- Oversized PEM exceeding 262144 characters will be rejected
- Empty certificate_pem field returns a validation error

## How this service works

Reads the constraints inside a single certificate — basic constraints, key usage, extended key usage — and reports, per role, whether the certificate permits being used that way under the pinned OpenSSL build's rules. Roles covered are TLS client, TLS server, S/MIME signing and encryption, and timestamp signing. This answers the frequent confusion where a certificate is deployed for a purpose its own extensions forbid, and the failure only shows up as an opaque handshake error later.

## Output

A structured report indicating, per role (TLS client, TLS server, S/MIME signing, S/MIME encryption, timestamp signing), whether the submitted certificate's extensions permit that role under the pinned OpenSSL build's evaluation rules — helping pinpoint mismatches between intended deployment and what the certificate's own constraints allow.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "certificate_pem": {
   "type": "string",
   "maxLength": 262144,
   "minLength": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-sicherwerk-x-509-certificate-purpose-evaluator-766b3166/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)