Package: showcert
showcert - simple OpenSSL for humansshowcert consist of two CLI utilities:showcertitself - all 'read' operations with X.509 certificates andgencert- to create certificates for development purposes.showcert tries to follow these principles:Simple things must be simple. More complex things may require some options.Be simple and cover 9/10 routine certificate-related tasks.If showcert missing some rarely used feature and user needs to use openssl for it - okay.showcertmicro-cheatsheet (only most often used commands):showcert github.com
showcert smtp.google.com:25
showcert --chain -o pem google.com > google-fullchain.pem
sudo showcert -q :le -w50 || echo local LetsEncrypt certificates will expire in less then 50 days# You will never forget how to use it:$showcertgithub.com
IP:140.82.121.3
Names:github.comwww.github.com
notBefore:2022-03-1500:00:00(182daysold)notAfter:2023-03-1523:59:59(183daysleft)Issuer:C=USO=DigiCertIncCN=DigiCertTLSHybridECCSHA3842020CA1# Compare it against openssl:# two redirections, pipe, two invokations and 5 unneeded options$openssls_client-connectgithub.com:443</dev/null2>/dev/null|opensslx509-informpem-text# View Google SMTP server cert. starttls mode selected automatically. Same for POP3/IMAP and any simple TLS service$showcertsmtp.google.com:25# Save full chain of google.com certificates to local PEM file$showcert--chain-opemgoogle.com>google-fullchain.pem# Warn about any LetsEncrypt cert which will expire in 50 days or less# :le is just special token, replaced to /etc/letsencrypt/live/*/fullchain.pem$sudoshowcert-q:le-w50||echopanic
/etc/letsencrypt/live/my.example.com/fullchain.pemexpiresin47days
panicSTARTTLS implementationshowcert has built-in support for STARTTLS for SMTP (port 25), POP3 (port 110) and IMAP (port 143). You can select proper method with--starttlsoption (or disable it with--starttls no), but default value (auto) is OK for most cases. This option is needed only if you test servers on non-standard ports.Exit codeshowcert will return non-zero exit code (1) in case of any error (including expired certificate or host mismatch).
If-w DAYSused, non-zero (2) will be returned for valid certificates, which will expire inDAYSdays or sooner.Usage$bin/showcert-h
usage:showcert[-h][-i][--outputOUTPUT][-c][-w[DAYS]][-q][-nNAME][-tMETHOD][-lTIME][--caCA][--net]CERT[CERT...]Showlocal/remoteSSLcertificateinfov0.1.15

positionalarguments:CERTpath,-(stdin),":le"(letsencryptcertpath),hostnameorhostname:port

optionalarguments:-h,--helpshowthishelpmessageandexit-i,--insecureDonotverifyremotecertificate--outputOUTPUT,-oOUTPUToutputformat:brief,full,names,dnames(forcertbot),pem,no.-c,--chainShowchain(notonlyservercertificate)-w[DAYS],--warn[DAYS]Warnaboutexpiringcertificates(def:20days)Rarelyneededoptions:-q,--quietQuietmode,sameas--outputno-nNAME,--nameNAMEnameforSNI(ifnotsameasCERThost)-tMETHOD,--starttlsMETHODstarttlsmethod:auto(default,andOKalmostalways),no,imap,smtp,pop3-lTIME,--limitTIMEsockettimeout(def:5)--caCApathtotrustedCAcertificates,def:/usr/local/lib/python3.9/dist-packages/certifi/cacert.pem--netForcenetworkcheck(ifyouwanttocheckhostandhavefile/dirwithsamenameincurrentdirectory)Examples:# just check remote certificatebin/showcertexample.com# check SMTP server certificate (autodetected: --starttls smtp )bin/showcertsmtp.google.com:25# save fullchain from google SMTP to local PEM filebin/showcert--chain-opemgoogle.com>google-fullchain.pem# look for expiring letsencrypt certificates# :le is alias for /etc/letsencrypt/live/*/fullchain.pembin/showcert:le-q-w20||echo"expiring soon!"gencertGencert is simple tool to quickly generate X.509 certificatesfor development purposes.
I am not sure if they are very secure. Do not use it in real production!Generate self-signed certgencertexample.comwww.example.comThis will makeexample.com.pemfile with both certificate and key in one file. Add--key example.com.keyto store key in separate file. Add--cert mycert.pemto store certificate in different file name.Your own CA in two simple commandsGenerate CA cert/key:gencert--ca"My own CA"This will make My-own-CA.pem and private key My-own-CA.key (Override with--certand--key).Generate signed certificate:gencert--cacertMy-own-CA.pemexample.comDone!--cacertis required,--cakeyis optional (omitted in example), gencert will look for CA private key in following order:in--cakeyPEM file (if given)in--cacertPEM file (if will be found there).guessed filename. If--cacertis CA.pem, gencert will try to load from CA.key.You may verify certificate with showcert and openssl:# verify with showcert (unless '-i' given, showcert expects a valid certificate)$showcert--caMyCA.pemexample.com.pem
Names:example.com
notBefore:2024-01-2611:30:24(0daysold)notAfter:2025-01-2511:30:24(364daysleft)Issuer:CN=MyCA# verify with openssl$opensslverify-CAfileMyCA.pemexample.com.pemexample.com.pem:OKInstallationpipx install showcertOr right from repo:pipx install git+https://github.com/yaroslaff/showcertOr use old way via pip/pip3:pip3 install showcert(just install)pip3 install -U showcert(upgrade)pip3 install -U git+https://github.com/yaroslaff/showcert(install/upgrade from git)