# Lookproof PEM Certificate Decoder

> Lookproof PEM Certificate Decoder is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-31).

Decodes a PEM-encoded X.509 certificate offline, returning subject, issuer, validity, SANs, key info, signature algorithm, CA flag, key usages, self-signed status, and SHA-256/SHA-1 fingerprints.

## Facts

- Endpoint: POST https://api.lookproof.dev/v1/tls/pem-decode?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-pem-certificate-decoder-0907d010
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_gNH4B2J6SLCIG85wdE8bP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-pem-certificate-decoder-0907d010 -d '<json body>'
```

Example prompt: I have a PEM certificate I'm about to install — can you decode it and tell me the subject, issuer, which DNS names it covers, how many days it's valid for, and its SHA-256 fingerprint? Here's the PEM: -----BEGIN CERTIFICATE-----...

## When to prefer this

Use this endpoint when an agent needs to inspect a single certificate file offline — without needing chain validation or OCSP/CRL revocation checks. Ideal for pre-deployment verification, fingerprint extraction, SAN enumeration, and expiry checks on a known PEM blob. Prefer the live TLS check endpoint (also on api.lookproof.dev) when you need to verify the certificate a server is actually serving in real time.

## Known failure modes

- Invalid or malformed PEM input returns a parse error
- PEM contains a non-certificate object (e.g. private key or CSR) and is rejected
- PEM string exceeds 16384 character limit
- Missing 'pem' field in request body causes validation error
- Certificate with unsupported encoding may fail to decode

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

A structured breakdown of the certificate including: subject DN, issuer DN, notBefore and notAfter dates, days remaining until expiry, list of DNS SANs and IP SANs, public key type and bit size, signature algorithm, whether the CA basic constraint is set, key usage and extended key usage flags, whether the certificate is self-signed, and both SHA-256 and SHA-1 fingerprints. No email addresses are returned. No chain building or revocation checking is performed (offline decode only).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "pem": {
   "type": "string",
   "title": "Pem",
   "maxLength": 16384,
   "minLength": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-pem-certificate-decoder-0907d010/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)