Skip to main content
emisar

Local SSL/TLS cert inspection

v0.1.15

Inspect TLS certificates and keys on the local filesystem — find PEMs under a path, dump x509 details, check chain, verify private-key match, inspect PKCS#12. Read-only. Pair with `network-tls` for the remote-side view.

7 allowed by default
Pack ID
ssl-local
Vendor
emisar
OS
linux
Actions
7
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
openssl

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install ssl-local --hash sha256:be57c785262c7bcbacd2c727e7bdf4646e5089d6bba11b546404aa08a4fb3dcb

Setup

Inspects certificate and key files on the local runner host's filesystem at the paths you pass as action arguments — no credentials needed.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Read root-owned or otherwise restricted certificate, key, and PKCS#12 files.

ssl.find_certsssl.cert_textssl.cert_expiryssl.cert_fingerprintssl.key_modulusssl.verify_chainssl.pkcs12_info

Run the Emisar service as root

Grant access 
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-ssl-local-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar
Verify access 
test "$(systemctl show emisar --property=User --value)" = root

Impact: Every Emisar action on this runner executes as root. These reads can reach private keys and PKCS#12 bundles even though pack output never intentionally prints key bytes.

Verify it works

Runs ssl.cert_expiry, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify ssl-local

Install and configure a pack walks through the whole sequence on a host.

Actions 7 total

View on GitHub
  • ssl.cert_expiry exec low Low — read-only or trivially reversible

    openssl x509 -enddate -subject

    Show cert expiry date + subject. Quick way to answer "is this about to expire?".

    View source on GitHub
  • ssl.cert_fingerprint exec low Low — read-only or trivially reversible

    openssl x509 -fingerprint -sha256

    Show the SHA-256 fingerprint of the cert. Use for pinning checks.

    View source on GitHub
  • ssl.cert_text exec low Low — read-only or trivially reversible

    openssl x509 -text -noout

    Dump a human-readable x509 certificate.

    View source on GitHub
  • ssl.find_certs exec low Low — read-only or trivially reversible

    find *.pem *.crt *.cer under <path>

    List certificate-like files under one path.

    View source on GitHub
  • ssl.key_modulus exec low Low — read-only or trivially reversible

    openssl rsa -modulus | sha256

    Show the hash of the RSA private key's modulus. Compare to the modulus hash of a cert (via `openssl x509 -modulus`) to confirm key + cert match. NEVER prints the key itself.

    View source on GitHub
  • ssl.pkcs12_info exec low Low — read-only or trivially reversible

    openssl pkcs12 -nokeys -info

    Inspect a PKCS#12 bundle's bag contents — cert subjects, key types — without exporting the private key. Requires the bundle's password via PK12_PASSWORD env var on the runner host (or empty for password-less bundles).

    View source on GitHub
  • ssl.verify_chain exec low Low — read-only or trivially reversible

    openssl verify -CAfile <bundle> <cert>

    Verify that a cert chains to a trusted root via a given CA bundle.

    View source on GitHub
← Back to registry
Pack reference  Publish your own