# X.509 TLS/SSL Certificate Inspector

> X.509 TLS/SSL Certificate Inspector is a paid API for AI agents from artifact-inspector.use.x402atlas.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-14).

Parses X.509 certificate fields and SANs, computes a SHA-256 fingerprint, and checks hostname and time validity without performing trust chain or revocation evaluation.

## Facts

- Endpoint: POST https://artifact-inspector.use.x402atlas.com/certificate?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x-509-tls-ssl-certificate-inspector-cc0d12b3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1EMvrSzviV8UWZTK_u9CK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x-509-tls-ssl-certificate-inspector-cc0d12b3 -d '<json body>'
```

Example prompt: Parse this PEM certificate for api.example.com, show me the issuer, SANs, SHA-256 fingerprint, and whether the certificate is currently time-valid and covers that hostname.

## When to prefer this

Use this endpoint when you need to programmatically inspect the contents of an X.509 certificate — extracting fields, SANs, fingerprint, or checking hostname and time validity — without needing a full trust-chain or revocation check. Prefer it over OpenSSL CLI calls in agentic workflows where you need structured JSON output. It is not a substitute for full TLS handshake verification or OCSP checks.

## Known failure modes

- Invalid or malformed PEM/DER input returns a parse error
- Hostname parameter missing when hostname validity is requested
- Certificate uses an unsupported encoding variant
- Input exceeds size limits for the bounded content inspector
- Payment not included or insufficient USDC balance returns 402

## How this service works

X.509 TLS/SSL certificate inspector — parse fields and SANs, calculate a SHA-256 fingerprint, and check hostname and time validity without trust or revocation claims.

## Output

Returns parsed X.509 certificate fields (subject, issuer, serial number, public key metadata, not-before/not-after validity dates), the list of Subject Alternative Names, a SHA-256 fingerprint of the certificate, a boolean indicating whether the provided hostname is covered by the certificate, and a boolean indicating whether the certificate is currently within its time validity window. Does not perform trust-chain validation or OCSP/CRL revocation checking.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x-509-tls-ssl-certificate-inspector-cc0d12b3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from artifact-inspector.use.x402atlas.com](https://www.zero.xyz/host/artifact-inspector.use.x402atlas.com/llms.txt)