Skip to main content
emisar

Local SSL/TLS cert inspection

v0.1.8

Inspect TLS certificates and keys on the local filesystem — find PEMs under a path, dump x509 details, check chain, verify private-key match, inspect PKCS#12. Read-only. Pair with `network-tls` for the remote-side view.

7 allowed by default
Pack ID
ssl-local
Vendor
emisar
OS
linux
Actions
7
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
openssl

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install ssl-local --hash sha256:523eb9116cb5622852ac42713d1a6e8999336053c591dba75dcbff3ec32708fe

Actions 7 total

View on GitHub
  • ssl.cert_expiry exec low

    openssl x509 -enddate -subject

    Show cert expiry date + subject. Quick way to answer "is this about to expire?".

    View source on GitHub
  • ssl.cert_fingerprint exec low

    openssl x509 -fingerprint -sha256

    Show the SHA-256 fingerprint of the cert. Use for pinning checks.

    View source on GitHub
  • ssl.cert_text exec low

    openssl x509 -text -noout

    Dump a human-readable x509 certificate.

    View source on GitHub
  • ssl.find_certs exec low

    find *.pem *.crt *.cer under <path>

    Lists certificate-like files under one path.

    View source on GitHub
  • ssl.key_modulus exec low

    openssl rsa -modulus | sha256

    Show the hash of the RSA private key's modulus. Compare to the modulus hash of a cert (via `openssl x509 -modulus`) to confirm key + cert match. NEVER prints the key itself.

    View source on GitHub
  • ssl.pkcs12_info exec low

    openssl pkcs12 -nokeys -info

    Inspect a PKCS#12 bundle's bag contents — cert subjects, key types — without exporting the private key. Requires the bundle's password via PK12_PASSWORD env var on the runner host (or empty for password-less bundles).

    View source on GitHub
  • ssl.verify_chain exec low

    openssl verify -CAfile <bundle> <cert>

    Verify that a cert chains to a trusted root via a given CA bundle.

    View source on GitHub
← Back to registry
Pack reference Publish your own →