ccheck for Mac

ccheck, simple X509 certificate checker with TAP output

This tool simplifies handling of PEM certificates. It allows for easy filtering of certificates based on the days until expiration. It's use is reminiscent of the grep utility.

It can produce Test Anything Protocol which makes this tool useful as part of test suites that deal with TLS certificate expiration.

Examples

Errors are sent to STDERR, the listing of certificates that satisfy the given criteria is sent to STDOUT but can be suppressed by using --quiet in the command line. TAP output is triggered by the --tap command line option.

TAP — Test Anything Protocol — support

TAP-formatted test results provide output that can be captured by more elaborate test suites:

JSON support

Output can be produced in JSON. Each spec provided in the command line will generate an entry in an array, with all available test information.

Custom certificate expiration check

Check whether a given certificate will expire _soon_, or within 10,000 days as in this example. Also whether the certificate is valid for the DNS name provided, is applicable:

Specifying 0 days with --min-days disables the expiration checking.

SNI support

When specifying hostnames for remote connections, the desired SNI can be added between parentheses as per the following example:

Certificate validation

By default, ccheck verifies that the certificate is valid for the domain name being used for testing. This can be disabled with the --skip-verify option:

Custom client certificate, custom Root CA processing

The --client-cert and --client-key allows for the specification of a custom client certificate pair.

--root-certs allows for specifying custom root CA certificates for validation of the received server certificate.

Certificates in local PEM files

Certificates can also be placed in local files:

The tests use a local copy of a current Google certificate chain. To quickly get an up-to-date copy, use the following command:

STARTTLS certificate validation

When using the --starttls command line option, ccheck will assume a connection to an ESMTP server and fetch the TLS certificates after issuing the STARTTLS command to start a new TLS session. This is useful to test submission servers as in this example:

PostgreSQL certificate validation

The --postgres command line flag instructs ccheck to treat the connection coordinates as the hostname and port number of a PostgreSQL database server. It then attempts a connection and uses the native line protocol to start a TLS session in which the server certificates are obtained and tested:

In the case above, the TLS certificate does not match the host name, so normal validation fails. If you're simply interested in checking the expiration date, you can add the --skip-verify flag as follows:

Dump certificate chain

The chain command provides a friendly text representation of the certificate chain sent by the TLS server, helpful for auditing certificate lineage.