Summary
One question, one answer, no PEM shuffling.
A certificate check usually means fetching a blob and feeding it through three more commands. Here you name a host and the whole analysis comes back in a single call.
What it is
A certificate analysis server with a single tool. Give it a hostname and it fetches the certificate, reads it, checks expiry, and optionally probes which cipher suites and TLS versions the host accepts — all in one call.
What you get
- fetch_certificate takes a hostname and port and returns subject, issuer, validity and SANs
- Expiry is reported in human terms: time remaining, or time elapsed since it lapsed
- Detailed analysis returns extensions and key information as well as the essentials
- analyze_ciphers, with cipher_scan_type set to quick or full, reports the cipher suites and TLS versions the host supports
- Linting runs zlint compliance checks; include_pem returns the raw certificate when you want it
- use_openssl picks OpenSSL where it is present, with a Python cryptography fallback
- A security grade from A+ to F on what came back
Requirements
Python. OpenSSL is used when available and the Python cryptography library covers it when not; zlint is only needed if you turn linting on.