certigo(1)

NAME
certigo

SYNOPSIS

certigo [<flags>] <command> [<args> ...]

DESCRIPTION
A command-line utility to examine and validate certificates to help with debugging SSL/TLS issues.

OPTIONS

-h, --help
    Show context-sensitive help (also try --help-long and --help-man).

-v, --verbose
    Print verbose

--version
    Show application version.

COMMANDS

  help [<command>...]

Show help.

  dump [<flags>] [<file>...]

Display information about a certificate from a file or stdin.

-f, --format=FORMAT
    Format of given input (PEM, DER, JCEKS, PKCS12; heuristic if missing).

-p, --password=PASSWORD
    Password for PKCS12/JCEKS key stores (reads from TTY if missing).

-m, --pem
    Write output as PEM blocks instead of human-readable format.

-j, --json
    Write output as machine-readable JSON format.

-l, --first
    Only display the first certificate. This flag can be paired with --json or --pem.

  connect [<flags>] <server[:port]>

Connect to a server and print its certificate(s).

-n, --name=NAME
    Override the server name used for Server Name Indication (SNI).

--ca=CA
    Path to CA bundle (system default if unspecified).

--cert=CERT
    Client certificate chain for connecting to server (PEM).

--key=KEY
    Private key for client certificate, if not in same file (PEM).

-t, --start-tls=PROTOCOL
    Enable StartTLS protocol; one of: [mysql postgres psql smtp ldap ftp imap].

--identity="certigo"
    With --start-tls, sets the DB user or SMTP EHLO name

--proxy=PROXY
    Optional URI for HTTP(s) CONNECT proxy to dial connections with

--timeout=5s
    Timeout for connecting to remote server (can be '5m', '1s', etc).

-m, --pem
    Write output as PEM blocks instead of human-readable format.

-j, --json
    Write output as machine-readable JSON format.

-l, --first
    Only display the first certificate. This flag can be paired with --json or --pem.

--verify
    Verify certificate chain.

--expected-name=EXPECTED-NAME
    Name expected in the server TLS certificate. Defaults to name from SNI or, if SNI not overridden, the hostname to connect to.

  verify --name=NAME [<flags>] [<file>]

Verify a certificate chain from file/stdin against a name.

-f, --format=FORMAT
    Format of given input (PEM, DER, JCEKS, PKCS12; heuristic if missing).

-p, --password=PASSWORD
    Password for PKCS12/JCEKS key stores (reads from TTY if missing).

-n, --name=NAME
    Server name to verify certificate against.

--ca=CA
    Path to CA bundle (system default if unspecified).

-j, --json
    Write output as machine-readable JSON format.