ssltool is a tool to check and generate certificates. It can inspect certificates from remote hosts, local files, or stdin.

• Getting Started
• Installation
• Usage
• Command Reference
• Contributing
• License

You can download the binary from the releases page or you can build it yourself.

You can run make

Or run go build from the root directory

You can just copy the binary to a location in your path or run it directly from the directory where you downloaded it.

Check the certificate details from a remote host:

./ssltool details --host www.example.com

Check the certificate details and print the certificate in PEM format:

./ssltool details --host www.example.com --cert

Check a service using a TLS certificate with a custom port:

./ssltool details --host ldaps.example.com --port 636

If it is using a self-signed certificate, you can use the --insecure flag to ignore the certificate errors:

./ssltool details --host ldaps.example.com --port 636 --insecure

Inspect a certificate from a file:

./ssltool details --file certificate.pem

Inspect a certificate from a file and display it in PEM format:

./ssltool details --file certificate.pem --cert

Inspect a certificate from stdin:

./ssltool details --stdin < certificate.pem

Pipe a certificate directly for inspection:

cat certificate.pem | ./ssltool details --stdin

Get certificate details in JSON format from a file:

./ssltool details --file certificate.pem --json

Check multiple hosts in a script:

for host in www.example.com api.example.com; do
  ./ssltool details --host "$host"
done

Download and inspect a certificate in one command:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 | ./ssltool details --stdin

Display certificate details and save the PEM to a file:

./ssltool details --host www.example.com --cert > cert.pem

Inspect multiple certificate files:

for cert in *.pem; do
  echo "=== $cert ==="
  ./ssltool details --file "$cert"
done

Generate a self-signed certificate request interactively:

./ssltool gen -c www.example.com

Generate a certificate request with environment variables for all fields:

LOCALITY="Bowling Green" PROVINCE="Kentucky" COUNTRY="US" ORG="Example ORG" OU="Example OU" ./ssltool gen -c www.example.com

Generate a certificate request with Subject Alternative Names (SANs):

./ssltool gen -c www.example.com -s www.example.com,api.example.com

Generate an ECDSA key instead of RSA:

./ssltool gen -c www.example.com --key-type ecdsa

Write the CSR and private key to files:

./ssltool gen -c www.example.com --csrout my.csr --keyout my.key

• --verbose, -v: Enable verbose logging for all commands.

Retrieve or inspect certificate details from a host, file, or stdin.

Flags:

• --host: Hostname to check certificate.
• --file, -f: Read certificate from file.
• --stdin, -s: Read certificate from stdin.
• --port: Port (default: 443)
• --insecure, -i: Don't verify certificates.
• --cert, -c: Print certificate in PEM format.
• --json, -j: Output results in JSON format.
• --validate, -V: Validate certificate chain and report issues.

Note: You must specify exactly one input source: --host, --file, or --stdin.

Examples:

• ssltool details --host www.example.com
• ssltool details --host www.example.com --cert
• ssltool details --host www.example.com --port 8443
• ssltool details --file certificate.pem
• ssltool details --file certificate.pem --json
• ssltool details --stdin < certificate.pem
• cat certificate.pem | ssltool details --stdin
• ssltool details --host www.example.com --validate

Used to generate a certificate request.

Flags:

• --cn, -c (required): Common name
• --sans, -s: Sans list. In the form www.example.com,www-prod01.example.edu
• --csrout: CSR out filename. - for stdout (default: -)
• --keyout: Key out filename. - for stdout (default: -)
• --bits, -b: RSA bits (only for RSA key type, default: 2048)
• --key-type, -k: Key type (rsa, ecdsa, ed25519; default: rsa)
• --json, -j: Output CSR and key in JSON format.

You can set the required parameters with the following environmental variables or you can enter them interactively: COUNTRY, ORG, OU, LOCALITY, and PROVINCE.

Examples:

• ssltool gen -c www.example.com
• ssltool gen -c www.example.com --key-type ecdsa
• ssltool gen -c www.example.com -s www.example.com,api.example.com
• ssltool gen -c www.example.com --json

If you would like to contribute, please open an issue or a pull request.

This project is licensed under the MIT License - see the LICENSE file for details.