Certificates

Decode an X.509 certificate or chain

POSThttps://ecdsa.com/api/v1/cert/decode

Accepts PEM (one or more CERTIFICATE blocks — a whole chain works) or a single DER certificate as base64/hex. Returns a structured summary per certificate — subject, issuer, validity, key and signature algorithms, SAN, key usage, fingerprint — plus assessments (weak hashes, expiry, CA/Browser Forum lifetime limits, post-quantum notes).

API-ключ: Необязателен; ключу нужна область доступа api
Расход квоты при вызове с ключом: 1 единица за вызов
Лимит запросов: 60 запросов в минуту с одного IP

Запрос

Тело запроса (JSON): CertDecodeRequest

Поле	Тип	Обязательное	Описание
certificate	string	да	PEM with one or more CERTIFICATE blocks (chains welcome), or one DER certificate as base64/hex.

Ответы

200Decoded certificates with assessments.

Поле	Тип	Обязательное	Описание
certificates	CertificateSummary[]	да
notes	string[]	да	Per-block problems and skipped-block notes.

Заголовки: X-Request-Id · X-RateLimit-Limit · X-RateLimit-Remaining · X-RateLimit-Reset · X-Quota-Limit · X-Quota-Remaining · X-Quota-Reset

Статус	Значение	Коды
400	Bad request. Input limits: a request body of at most 100 KB (a larger one is answered with 413) and arrays and objects nested at most 64 levels deep, JSON documents inside string fields included.	invalid_json missing_field invalid_input private_key_rejected
401	Unauthorized.	unauthorized
403	Forbidden.	forbidden_scope
404	Not found.	not_found
405	Method not allowed.	method_not_allowed
413	Payload too large.	payload_too_large
429	Too many requests.	rate_limited quota_exceeded
500	Internal server error.	internal_error
503	Service unavailable.	service_unavailable
504	Gateway timeout.	timeout

Каждый ответ с ошибкой содержит JSON-объект ошибки; что означает каждый код и что с ним делать, сказано в таблице ошибок.

Пример

A self-signed ECDSA P-256 certificate

curl

curl -sS 'https://ecdsa.com/api/v1/cert/decode' \
  -H 'content-type: application/json' \
  -d '{
  "certificate": "-----BEGIN CERTIFICATE-----\nMIICFjCCAbugAwIBAgIIBKGyw9Tl9gcwCgYIKoZIzj0EAwIwSDEXMBUGA1UEAxMO\nZGVtby5lY2RzYS5jb20xIDAeBgNVBAoTF0VDRFNBLmNvbSBTaWduYXR1cmUgTGFi\nMQswCQYDVQQGEwJVUzAeFw0yNjAxMTUwMDAwMDBaFw0yNzAxMTUwMDAwMDBaMEgx\nFzAVBgNVBAMTDmRlbW8uZWNkc2EuY29tMSAwHgYDVQQKExdFQ0RTQS5jb20gU2ln\nbmF0dXJlIExhYjELMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC\nAASOtEAsuQh2j8SNY/hVbkvFlXwHUzLXZjcTsaEcuwwvXCVsldoaP1Orr1h16iU+\nqjEAP2gmZSM2XbSN3B+h59Lko4GOMIGLMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAtBgNVHREEJjAk\ngg5kZW1vLmVjZHNhLmNvbYISd3d3LmRlbW8uZWNkc2EuY29tMB0GA1UdDgQWBBTp\nEL0Utu1R8qzHZ9IWC2WP789lqTAKBggqhkjOPQQDAgNJADBGAiEAjad1xoTy9SXd\nd8DnZMIA4jkASCGkYSc1R9io7mj83NcCIQDE0GDEHRLcXxZVdZgDcJjSPRx6cLqM\n4v4zJDEFLZ5reA==\n-----END CERTIFICATE-----"
}'

JavaScript (fetch)

const response = await fetch("https://ecdsa.com/api/v1/cert/decode", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "certificate": "-----BEGIN CERTIFICATE-----\nMIICFjCCAbugAwIBAgIIBKGyw9Tl9gcwCgYIKoZIzj0EAwIwSDEXMBUGA1UEAxMO\nZGVtby5lY2RzYS5jb20xIDAeBgNVBAoTF0VDRFNBLmNvbSBTaWduYXR1cmUgTGFi\nMQswCQYDVQQGEwJVUzAeFw0yNjAxMTUwMDAwMDBaFw0yNzAxMTUwMDAwMDBaMEgx\nFzAVBgNVBAMTDmRlbW8uZWNkc2EuY29tMSAwHgYDVQQKExdFQ0RTQS5jb20gU2ln\nbmF0dXJlIExhYjELMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC\nAASOtEAsuQh2j8SNY/hVbkvFlXwHUzLXZjcTsaEcuwwvXCVsldoaP1Orr1h16iU+\nqjEAP2gmZSM2XbSN3B+h59Lko4GOMIGLMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAtBgNVHREEJjAk\ngg5kZW1vLmVjZHNhLmNvbYISd3d3LmRlbW8uZWNkc2EuY29tMB0GA1UdDgQWBBTp\nEL0Utu1R8qzHZ9IWC2WP789lqTAKBggqhkjOPQQDAgNJADBGAiEAjad1xoTy9SXd\nd8DnZMIA4jkASCGkYSc1R9io7mj83NcCIQDE0GDEHRLcXxZVdZgDcJjSPRx6cLqM\n4v4zJDEFLZ5reA==\n-----END CERTIFICATE-----"
  }),
});
console.log(response.status, await response.json());

Python (httpx)

import httpx

response = httpx.post(
    "https://ecdsa.com/api/v1/cert/decode",
    json={
        "certificate": "-----BEGIN CERTIFICATE-----\nMIICFjCCAbugAwIBAgIIBKGyw9Tl9gcwCgYIKoZIzj0EAwIwSDEXMBUGA1UEAxMO\nZGVtby5lY2RzYS5jb20xIDAeBgNVBAoTF0VDRFNBLmNvbSBTaWduYXR1cmUgTGFi\nMQswCQYDVQQGEwJVUzAeFw0yNjAxMTUwMDAwMDBaFw0yNzAxMTUwMDAwMDBaMEgx\nFzAVBgNVBAMTDmRlbW8uZWNkc2EuY29tMSAwHgYDVQQKExdFQ0RTQS5jb20gU2ln\nbmF0dXJlIExhYjELMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC\nAASOtEAsuQh2j8SNY/hVbkvFlXwHUzLXZjcTsaEcuwwvXCVsldoaP1Orr1h16iU+\nqjEAP2gmZSM2XbSN3B+h59Lko4GOMIGLMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/\nBAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAtBgNVHREEJjAk\ngg5kZW1vLmVjZHNhLmNvbYISd3d3LmRlbW8uZWNkc2EuY29tMB0GA1UdDgQWBBTp\nEL0Utu1R8qzHZ9IWC2WP789lqTAKBggqhkjOPQQDAgNJADBGAiEAjad1xoTy9SXd\nd8DnZMIA4jkASCGkYSc1R9io7mj83NcCIQDE0GDEHRLcXxZVdZgDcJjSPRx6cLqM\n4v4zJDEFLZ5reA==\n-----END CERTIFICATE-----",
    },
    timeout=30.0,
)
print(response.status_code, response.json())

Ответ 200

{
  "certificates": [
    {
      "subject": "CN=demo.ecdsa.com, O=ECDSA.com Signature Lab, C=US",
      "issuer": "CN=demo.ecdsa.com, O=ECDSA.com Signature Lab, C=US",
      "selfSigned": true,
      "serialNumber": "04:a1:b2:c3:d4:e5:f6:07",
      "version": 3,
      "notBefore": "2026-01-15T00:00:00.000Z",
      "notAfter": "2027-01-15T00:00:00.000Z",
      "validityStatus": "valid",
      "daysRemaining": 87,
      "lifetimeDays": 365,
      "publicKeyLabel": "ECDSA P-256",
      "signatureLabel": "ecdsa-with-SHA256",
      "san": [
        "DNS:demo.ecdsa.com",
        "DNS:www.demo.ecdsa.com"
      ],
      "keyUsage": [
        "digitalSignature"
      ],
      "extendedKeyUsage": [
        "serverAuth",
        "clientAuth"
      ],
      "basicConstraints": {
        "ca": false
      },
      "subjectKeyId": "e9:10:bd:14:b6:ed:51:f2:ac:c7:67:d2:16:0b:65:8f:ef:cf:65:a9",
      "authorityKeyId": null,
      "fingerprintSha256": "54:7A:73:8B:31:CE:3A:55:54:58:4B:5C:FD:D8:CE:7F:78:B7:05:15:29:A3:B7:D5:38:FA:3D:A7:93:5E:C2:CA",
      "assessments": [
        {
          "kind": "info",
          "title": "Classical algorithm — post-quantum migration ahead",
          "body": "ECDSA P-256 (≈128-bit classical security) is a sound choice today. It is, however, quantum-vulnerable: NIST IR 8547 (draft) plans to disallow classical signature algorithms — ECDSA, EdDSA and RSA — after 2035. At this key size there is no earlier 2030 milestone — that step applies only to 112-bit parameter sets such as RSA-2048. No emergency — but worth an inventory: our upcoming repository scanner maps where your systems still sign with classical algorithms and the matching post-quantum migration targets."
        },
        {
          "kind": "ok",
          "title": "Within validity period",
          "body": "Valid until 2027-01-15 00:00:00 UTC — 87 days remaining."
        }
      ]
    }
  ],
  "notes": []
}

Ответ API на этот пример, полученный для этой страницы 20 октября 2026 г.; относительное время и количество дней в нём отсчитываются от этого дня.

Коды ошибок

Код	Статус	Значение
invalid_json	400	The body is not valid JSON or not a JSON object; or the input nests arrays and objects more than 64 levels deep (JSON documents inside string fields count too), or is too complex to inspect for private keys.
missing_field	400	A required field is absent or empty.
invalid_input	400	A field could not be parsed — the message explains exactly why.
private_key_rejected	400	The request contains private-key material (a PEM PRIVATE KEY block, an OpenSSH, SSH2 or PuTTY private key, or a JWK with "d"). Never send private keys anywhere.
unauthorized	401	The Authorization or X-API-Key header is malformed, the API key is not valid (wrong checksum, unknown, revoked or expired), or the operation needs a key.
forbidden_scope	403	The API key is valid but lacks a scope this operation requires; the message names it.
not_found	404	No operation exists at this path.
method_not_allowed	405	The path exists but does not accept this HTTP method; see the Allow header.
payload_too_large	413	The body exceeds 100 KB.
rate_limited	429	Too many requests — see Retry-After.
quota_exceeded	429	A daily or monthly quota of the API key's account is used up. X-Quota-Reset (and Retry-After) say when it starts over; retrying earlier cannot succeed.
internal_error	500	Unexpected server error.
service_unavailable	503	API keys cannot be verified right now (the key store is unreachable); retry shortly.
timeout	504	The operation did not finish within its time budget.

Схемы

CertificateSummary

Поле	Тип	Обязательное	Описание
subject	string	да
issuer	string	да
selfSigned	boolean	да	Subject and issuer are identical.
serialNumber	string	да	Colon-separated hex.
version	integer \| null	да
notBefore	string	да	формат date-time
notAfter	string	да	формат date-time
validityStatus	string	да	одно из значений "valid", "expiring", "expired" или "not-yet-valid"
daysRemaining	integer	да	Days until notAfter (zero or negative once expired).
lifetimeDays	integer	да
publicKeyLabel	string	да
signatureLabel	string	да
san	string[]	да	"DNS:example.com" style Subject Alternative Name entries.
keyUsage	string[]	да
extendedKeyUsage	string[]	да
basicConstraints	object \| null	да
basicConstraints.ca	boolean	да
basicConstraints.pathLength	integer	нет
subjectKeyId	string \| null	да
authorityKeyId	string \| null	да
fingerprintSha256	string	да	Colon-separated uppercase hex SHA-256 of the DER.
assessments	CertificateAssessment[]	да

CertificateAssessment

Поле	Тип	Обязательное	Описание
kind	string	да	одно из значений "ok", "err", "warn" или "info"
title	string	да
body	string	да

Error

The error envelope of every non-2xx response.

Поле	Тип	Обязательное	Описание
error	object	да
error.code	string	да	Machine-readable error code. Each response lists the codes it can carry; new codes may be added within v1, so treat an unknown code by its HTTP status.
error.message	string	да	Human-readable explanation (English).
error.requestId	string	нет	The X-Request-Id of this request — quote it when reporting a problem. Sent since v1.1.
error.detail	object	нет	Structured context for the error, such as the offending field; omitted when there is none. поля с любыми именами
error.docs	string	нет	Where the error codes are explained. Sent since v1.1. формат uri

Все операции перечислены в справочнике API.