certinspect 1.7.0

Command-line TLS certificate inspector

TLS inspection · Expiry alerts · OCSP/CRL revocation · Chain of trust · Batch & concurrency · STARTTLS · CI-friendly exit codes

PyPI · Usage · Use cases · Options · Recipes · Exit codes · Changelog · Issues

Point it at a host. Learn the truth about its TLS certificate. Expiry, chain of trust, OCSP/CRL revocation, weak crypto, hostname match — one dependency, one command, and machine-readable output when a robot is watching.

certinspect is a single-purpose, no-nonsense command-line X.509/TLS inspector built for humans and cron jobs. It speaks plain text, JSON, CSV, Nagios and Prometheus, exits with meaningful status codes, runs the whole batch in parallel, and never phones home. No openssl s_client | openssl x509 -noout -text incantations, no browser clicking through padlock dialogs.

$ certinspect example.com
=== example.com ===
Subject:        CN=example.com
Status:         VALID
Days to expiry: 64
Signature:      ecdsa-with-SHA256
Key size:       256 bit
TLS version:    TLSv1.3
Cipher:         TLS_AES_256_GCM_SHA384
Hostname match: True
...
$ echo $?      # 0 = healthy, 3 = expiring, 4 = expired, 6 = revoked, ...
0

Features

Area	What you get
Certificate facts	Validity & days to expiry, total validity period, subject & issuer, SAN (DNS and IP), SHA-256 fingerprint, CA / self-signed flags, key usage & extended key usage, embedded Certificate Transparency SCT count, OCSP Must-Staple flag
Crypto health	Signature algorithm & key size, weak-crypto warnings, negotiated TLS version & cipher
Trust & revocation	Chain verification + OCSP/CRL revocation against the system trust store (--verify), or a private/internal CA bundle (--cafile/--capath); show the server-presented chain (--chain)
Chain hygiene	Warn about expired or soon-to-expire intermediate/root CA certificates in the chain
Identity checks	Hostname match against the certificate, SHA-256 fingerprint pinning (--pin), SAN coverage assertions (--expect-san), SNI override for backends behind a load balancer (--servername)
Policy enforcement	Opt-in checks that fail (exit code 9): maximum total validity (--not-after-max, or --cab-forum for the date-aware CA/Browser Forum cap), minimum key size (--min-key-size), promote weak-crypto warnings to failures (--fail-weak), require embedded Certificate Transparency SCTs (--require-sct), require the OCSP Must-Staple extension (--require-must-staple), or enforce a minimum negotiated TLS version (--min-tls-version)
Batch & speed	Inspect many hosts at once, in parallel (--concurrency), from args or a file (--input)
Output formats	Plain text, JSON (--json), CSV (--csv), single-field lines for scripting (--field), Nagios/Icinga & Prometheus (--exporter)
Triage helpers	Only certs expiring within N days (--max-days), sort by host or soonest expiry (--sort), one-line tally (--summary), tighter CRITICAL threshold (--critical-days)
Protocols	Direct TLS plus STARTTLS — SMTP, IMAP, POP3, FTP (--starttls)
Connectivity	Mutual-TLS client certificates (--client-cert/--client-key) and HTTP CONNECT proxy tunnelling (--proxy) for hosts behind a corporate/cloud egress proxy
Automation	Meaningful exit codes for cron/CI (or force success with --exit-zero), no telemetry, single runtime dependency

Requirements

• Python >= 3.10

Installation

pip install certinspect

From source (development)

python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

Usage

# Inspect a host
certinspect example.com

# A full URL or host:port works too (scheme and path are ignored)
certinspect https://example.com/login
certinspect example.com:8443

# Multiple hosts at once (batch mode)
certinspect example.com github.com api.example.com

# Inspect many hosts in parallel (output order is preserved)
certinspect example.com github.com api.example.com --concurrency 10

# Custom port
certinspect example.com --port 8443

# Custom connection timeout in seconds (default: 5)
certinspect example.com --timeout 10

# JSON output (always a list of objects)
certinspect example.com --json

# CSV output (one row per target, with a header) for spreadsheets
certinspect example.com github.com --csv

# CSV with a ';' separator (Numbers/Excel in some locales, e.g. Italian)
certinspect example.com github.com --csv --csv-delimiter ';'

# Inspect a local certificate
certinspect --file ./certificate.pem

# Or pipe a certificate in from stdin
openssl s_client -connect example.com:443 </dev/null 2>/dev/null | certinspect --file -

# Custom expiry warning threshold (default: 30 days)
certinspect example.com --days 14

# Two-tier thresholds: WARNING within 30 days, CRITICAL within 7 (exit 4)
certinspect example.com github.com --days 30 --critical-days 7

# Only print certificates that have a problem
certinspect example.com github.com --quiet

# Only print certificates expiring within N days (expired ones always shown)
certinspect example.com github.com --max-days 30

# Sort the batch output by soonest expiry (or alphabetically by host)
certinspect example.com github.com --sort expiry
certinspect example.com github.com --sort host

# Print a one-line tally (to stderr) after the report
certinspect example.com github.com --summary
# summary: 1 valid · 1 expiring · 0 expired (2 targets)

# Verify the certificate chain against the system trust store
certinspect example.com --verify

# Verify against an internal/private CA instead of the system trust store
certinspect internal.example.lan --verify --cafile ./internal-ca.pem
certinspect internal.example.lan --verify --capath /etc/ssl/internal-certs

# Show the certificate chain presented by the server
certinspect example.com --chain

# Fail (exit 7) unless the fingerprint matches the expected pin
certinspect example.com --pin AA:BB:CC:...

# Reach a specific backend by IP but present the virtual host via SNI
# (the hostname match is checked against --servername)
certinspect 10.0.0.5 --servername api.example.com

# Assert the certificate covers one or more names (exit 8 if any is missing)
certinspect example.com --expect-san www.example.com
certinspect example.com --expect-san example.com --expect-san api.example.com

# Read targets from a file (or '-' for stdin)
certinspect --input hosts.txt
cat hosts.txt | certinspect --input -

# Save the fetched certificate as PEM
certinspect example.com --export ./fetched.pem

# Inspect a certificate behind STARTTLS (smtp, imap, pop3, ftp)
# The protocol's standard port is used unless --port is given
certinspect mail.example.com --starttls smtp
certinspect mail.example.com --starttls imap --port 143

# Monitoring output: a Nagios/Icinga plugin line per target
# (exit code follows the plugin convention: 0=OK, 1=WARNING, 2=CRITICAL)
certinspect example.com --exporter nagios

# Monitoring output: Prometheus textfile-collector metrics
certinspect example.com github.com --exporter prometheus

# Print the version
certinspect --version

Example

$ certinspect pypi.org --verify
=== pypi.org ===
Subject:        CN=pypi.org
Status:         VALID

Issuer:         CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4,O=GlobalSign nv-sa,C=BE
Valid from:     2025-12-28 04:33:08+00:00
Valid until:    2027-01-29 04:33:07+00:00
Days to expiry: 217
Total validity: 396 days

Serial number:  1587345912129534630556007389588586994
Signature:      sha256WithRSAEncryption
Key size:       2048 bit
Fingerprint:    15:58:1C:41:02:3F:07:89:85:31:4E:7D:4C:4F:8A:CA:BF:05:C7:F6:...
CA:             False
Self-Signed:    False
TLS version:    TLSv1.3
Cipher:         TLS_AES_128_GCM_SHA256
Key usage:      digital_signature, key_encipherment
Ext. key usage: serverAuth, clientAuth
Hostname match: True
Chain trusted:  True
Revocation:     GOOD

SAN:
  - pypi.org
  - *.pypi.org
  - www.pypi.org
  - donate.pypi.org

With --verify, certinspect opens a fully verified TLS handshake (chain + hostname against the Python/OpenSSL trust store) and, when the certificate advertises an OCSP responder, queries it for the revocation status. If OCSP is unavailable, certinspect falls back to the certificate's CRL distribution points (downloaded over HTTP and verified against the issuer). Both checks are soft-fail: when neither OCSP nor the CRL gives an answer the status is UNAVAILABLE and the exit code is unchanged, while a REVOKED status fails with exit code 6.

When the responder is down (or the certificate has no OCSP URL at all) the CRL fallback can still catch a revoked certificate; the via CRL note shows which source answered:

$ certinspect revoked.example.com --verify
=== revoked.example.com ===
Subject:        CN=revoked.example.com
Status:         VALID
...
Chain trusted:  True
Revocation:     REVOKED
WARNING: certificate revoked (revoked at 2026-05-14 09:21:03+00:00 (via CRL))
$ echo $?
6

certinspect also inspects the other certificates in the chain (the verified chain with --verify, otherwise the chain presented by the server) and warns when an intermediate or root CA is already expired or expires within the --days window — an expired intermediate breaks the chain even when the leaf itself is still valid:

$ certinspect internal.example.lan --verify --cafile ./internal-ca.pem
=== internal.example.lan ===
Subject:        CN=internal.example.lan
Status:         VALID
...
Chain trusted:  True
WARNING: chain certificate 'Example Intermediate CA' expires in 12 days
WARNING: chain certificate 'Example Legacy Root CA' expired 3 days ago
Revocation:     GOOD

Use cases

Real-world scenarios and the command that covers each. Every check is exit-code driven, so it drops straight into cron, CI or a monitoring stack.

Keep a whole fleet from expiring

Inspect every host in parallel, show only what expires within 30 days, soonest first:

certinspect --input fleet.txt --concurrency 20 --max-days 30 --sort expiry

Fail a CI build before a cert bites you

Non-zero exit (3 expiring, 4 expired, ...) stops the pipeline:

certinspect --input fleet.txt --days 14 --quiet || exit 1

Validate a freshly issued cert before deploying it

No network needed — assert the file covers every hostname you serve (exit 8 if any SAN is missing). Catches an ACME renewal that silently dropped a name:

certinspect --file ./new-cert.pem \
  --expect-san example.com --expect-san www.example.com --expect-san api.example.com \
  || { echo "cert incomplete, blocking deploy"; exit 1; }

Check one node behind a load balancer / anycast IP

Connect to a specific backend by IP but present the virtual host via SNI; the hostname match is checked against the name you expect:

certinspect 10.0.0.5 --servername api.example.com --verify

Inspect services behind an internal / private PKI

Verify the chain against your own CA bundle instead of the system trust store:

certinspect internal.example.lan --verify --cafile ./internal-ca.pem

Catch a revoked certificate

--verify queries OCSP and falls back to the CRL; a revoked leaf fails with exit 6:

certinspect example.com --verify

Spot an expired intermediate before it breaks the chain

An expired intermediate silently breaks trust even when the leaf is still valid; certinspect warns about it:

certinspect example.com --verify --days 30

Inspect mail / FTP servers (STARTTLS)

Upgrade a plaintext protocol to TLS before reading the certificate:

certinspect smtp.example.com --starttls smtp
certinspect imap.example.com --starttls imap

Pin a certificate and alert on unexpected changes

Fail with exit 7 if the fingerprint ever differs from the expected pin:

certinspect example.com --pin BE:AB:14:CF:39:...

Feed a monitoring stack

Nagios/Icinga plugin lines or Prometheus textfile metrics (see Monitoring):

certinspect --input fleet.txt --exporter prometheus \
  > /var/lib/node_exporter/textfile/certinspect.prom

Audit a fleet into a spreadsheet

CSV with a locale-friendly separator, one row per host:

certinspect --input fleet.txt --csv --csv-delimiter ';' > certs.csv

Separate a warning window from a critical one

Two-tier thresholds let alerting distinguish "renew soon" (exit 3) from "renew now" (exit 4) — e.g. page on-call only for the critical window:

certinspect --input fleet.txt --days 30 --critical-days 7

Send a nightly expiry digest

Only what expires within 30 days, soonest first, with a one-line tally on stderr, piped to mail:

certinspect --input fleet.txt --max-days 30 --sort expiry --summary \
  | mail -s "Certs expiring soon" [e-mail]

Pipe results into other tooling

JSON is always a list of objects — feed it to jq, a dashboard or a script:

# Every host sorted by days left
certinspect --input fleet.txt --concurrency 20 --json \
  | jq -r 'sort_by(.days_to_expire)[] | "\(.days_to_expire)d  \(.subject)"'

# Grab just the SHA-256 fingerprint (e.g. to pin it later)
certinspect example.com --json | jq -r '.[0].fingerprint_sha256'

Inspect a service on a non-standard TLS port

Databases, message brokers, admin panels and custom services rarely live on 443:

certinspect db.example.com --port 5432        # Postgres over TLS
certinspect broker.example.com --port 8883     # MQTT over TLS

Probe slow or high-latency endpoints

Raise the connection timeout for far-away regions or throttled links (default 5s):

certinspect edge.ap-southeast-2.example.com --timeout 15

Debug the exact chain a server presents

See every certificate the server sends (leaf → intermediates), to diagnose a missing or mis-ordered intermediate:

certinspect example.com --chain

Archive the served certificate

Save the fetched leaf as PEM for auditing, diffing or extracting a pin:

certinspect example.com --export ./example.com.pem

Options

Option	Description
target...	One or more domains, URLs or host:port to inspect. Omit when using --file.
--file PATH	Inspect a local certificate (PEM or DER) instead of a host. Use - to read the certificate from standard input.
--port N	TCP port to connect to (default: 443).
--timeout N	Connection timeout in seconds (default: 5).
--json	Print the result as JSON instead of human-readable text.
--csv	Print the results as CSV (one row per target, with a header).
--csv-delimiter SEP	Field separator for --csv (default ,). Use ; for Numbers/Excel in locales that expect it.
--quiet	Only print certificates that have a problem.
--verify	Verify the chain + OCSP/CRL revocation, system trust store (hosts only).
--cafile PATH	Verify the chain against this CA bundle (PEM) instead of the system trust store. Requires --verify; for internal/private PKI.
--capath DIR	Verify the chain against the hashed CA certificates in this directory (OpenSSL c_rehash layout). Requires --verify; may be combined with --cafile.
--chain	Show the certificate chain presented by the server.
--client-cert PATH	Present a client certificate (PEM) for mutual-TLS endpoints (host targets only). Use --client-key when the key is stored separately.
--client-key PATH	Private key (PEM) for --client-cert when stored separately from the certificate.
--proxy URL	Tunnel the connection through an HTTP CONNECT proxy, e.g. http://proxy:8080 or http://user:pass@proxy:8080 (host targets only).
--pin SHA256	Fail (exit 7) unless the SHA-256 fingerprint matches (colons/case ignored).
--servername NAME	Override the SNI hostname sent in the handshake (hosts only); the hostname match is checked against NAME. For reaching a backend by IP behind a load balancer.
--expect-san NAME	Assert the certificate's SAN covers NAME (wildcards honored); exit 8 if missing. Repeatable; works for host and --file targets.
--not-after-max N	Fail (exit 9) when the total validity exceeds N days (use 398 for the CA/Browser Forum maximum). Opt-in; works for host and --file targets.
--cab-forum	Fail (exit 9) when the total validity exceeds the CA/Browser Forum maximum in effect today (398 days now, then 200, 100 and 47 on 2026/2027/2029-03-15). Date-aware shorthand for --not-after-max; mutually exclusive with it.
--min-key-size N	Fail (exit 9) when the public key is smaller than N bits (e.g. 2048 for RSA). Opt-in.
--fail-weak	Turn the weak-crypto warnings (small key, SHA-1/MD5 signature) into a hard failure (exit 9) instead of a mere warning.
--require-sct	Fail (exit 9) when the certificate embeds no Signed Certificate Timestamps (Certificate Transparency). Checks embedded SCTs only, not those from the TLS handshake or OCSP. Opt-in.
--require-must-staple	Fail (exit 9) when the certificate lacks the OCSP Must-Staple extension (RFC 7633 TLS Feature status_request). Opt-in.
--min-tls-version VER	Fail (exit 9) when the connection negotiates a TLS version older than VER (TLSv1, TLSv1.1, TLSv1.2, TLSv1.3). Host targets only; opt-in.
--input PATH	Read extra targets from a file, one per line ('-' for stdin).
--days N	Warn if the certificate expires within N days (default: 30).
--critical-days N	Escalate to CRITICAL (exit code 4) when the certificate expires within N days. Must be <= --days; feeds Nagios CRITICAL and the --summary critical count.
--max-days N	Only show certificates expiring within N days (expired ones always shown; filters display only).
--sort host|expiry	Sort the output by host (alphabetical) or by soonest expiry (display only; does not affect exit code).
--summary	Print a one-line tally (valid/expiring/expired/errors) to stderr; counts every target before filtering.
--field NAME	Print only the given field(s), one tab-separated line per target (repeatable; target for the host). For scripting without a JSON tool.
--exit-zero	Always exit 0, even on problems or fetch errors. Report-only mode for dashboards/CI that read the output, not the exit code.
--export PATH	Save the inspected certificate as a PEM file at PATH.
--starttls {smtp,imap,pop3,ftp}	Upgrade a plaintext connection to TLS before inspecting (standard port unless --port is given).
--exporter {nagios,prometheus}	Emit machine-readable monitoring output (ignores --quiet).
--concurrency N	Inspect up to N hosts in parallel in batch mode (default: 1; order is preserved).
--version	Print the version and exit.

Options in action

Worked examples with real output for every option. Long values (fingerprints, issuer names) are trimmed with ...; $? is the process exit code.

target — inspect a host

$ certinspect example.com
=== example.com ===
Subject:        CN=example.com
Status:         VALID

Issuer:         CN=Cloudflare TLS Issuing ECC CA 3,O=SSL Corporation,C=US
Valid from:     2026-05-31 21:39:12+00:00
Valid until:    2026-08-29 21:41:26+00:00
Days to expiry: 64
Total validity: 90 days

Serial number:  35428337808578903465180920265426569102
Signature:      ecdsa-with-SHA256
Key size:       256 bit
Fingerprint:    BE:AB:14:CF:39:67:8F:DA:0E:F1:60:6E:ED:B8:18:C2:...
CA:             False
Self-Signed:    False
TLS version:    TLSv1.3
Cipher:         TLS_AES_256_GCM_SHA384
Key usage:      digital_signature
Ext. key usage: serverAuth
Hostname match: True

SAN:
  - example.com
  - *.example.com

Passing several hosts prints one === host === block per target (batch mode).

--file PATH — inspect a local certificate

No live handshake, so there is no === host === header, no TLS version/cipher and no hostname match.

$ certinspect --file ./fetched.pem
Subject:        CN=example.com
Status:         VALID

Issuer:         CN=Cloudflare TLS Issuing ECC CA 3,O=SSL Corporation,C=US
Valid from:     2026-05-31 21:39:12+00:00
Valid until:    2026-08-29 21:41:26+00:00
...

--port N / --timeout N — connection tuning

The report is identical to a plain inspection; only how/where certinspect connects changes.

$ certinspect example.com --port 443 --timeout 10
=== example.com ===
Subject:        CN=example.com
Status:         VALID
...

--json

$ certinspect example.com --json
[
  {
    "subject": "CN=example.com",
    "issuer": "CN=Cloudflare TLS Issuing ECC CA 3,O=SSL Corporation,C=US",
    "not_valid_before": "2026-05-31 21:39:12+00:00",
    "not_valid_after": "2026-08-29 21:41:26+00:00",
    "serial_number": 35428337808578903465180920265426569102,
    "signature_algorithm": "ecdsa-with-SHA256",
    "days_to_expire": 64,
    "validity_days": 90,
    "key_size": 256,
    "san": ["example.com", "*.example.com"],
    "fingerprint_sha256": "BE:AB:14:CF:39:67:8F:DA:...",
    "is_ca": false,
    "self_signed": false,
    "key_usage": ["digital_signature"],
    "extended_key_usage": ["serverAuth"],
    "weak": [],
    "tls_version": "TLSv1.3",
    "cipher": "TLS_AES_256_GCM_SHA384",
    "hostname_match": true,
    "status": "VALID"
  }
]

The status field mirrors the human report's Status line (VALID, EXPIRING, CRITICAL, EXPIRED, NOT YET VALID or INVALID DATES) and honors --days / --critical-days, so a JSON consumer gets the verdict without re-deriving it from the dates.

--csv / --csv-delimiter SEP

$ certinspect example.com github.com --csv
target,common_name,status,days_to_expire,valid_from,valid_until,issuer,hostname_match
example.com,example.com,VALID,64,2026-05-31 21:39:12+00:00,2026-08-29 21:41:26+00:00,Cloudflare TLS Issuing ECC CA 3,True
github.com,github.com,VALID,37,2026-05-05 00:00:00+00:00,2026-08-02 23:59:59+00:00,Sectigo Public Server Authentication CA DV E36,True

$ certinspect example.com --csv --csv-delimiter ';'
target;common_name;status;days_to_expire;valid_from;valid_until;issuer;hostname_match
example.com;example.com;VALID;64;2026-05-31 21:39:12+00:00;2026-08-29 21:41:26+00:00;Cloudflare TLS Issuing ECC CA 3;True

--quiet

Healthy certificates produce no output; only problem targets (and fetch errors) are printed.

$ certinspect example.com github.com --quiet
$ echo $?
0

--verify (+ --cafile PATH / --capath DIR)

Adds Chain trusted and Revocation to the report.

$ certinspect example.com --verify
...
Hostname match: True
Chain trusted:  True
Revocation:     GOOD

SAN:
  - example.com
  - *.example.com

Verify against a specific CA bundle instead of the system trust store (useful behind an internal/private PKI):

$ certinspect example.com --verify --cafile /path/to/ca-bundle.pem
...
Chain trusted:  True
Revocation:     GOOD

--chain

$ certinspect example.com --chain
...
Certificate chain:
  [0] CN=example.com
      issuer:  CN=Cloudflare TLS Issuing ECC CA 3,O=SSL Corporation,C=US
      expires: 2026-08-29 21:41:26+00:00
      CA:      False
  [1] CN=Cloudflare TLS Issuing ECC CA 3,O=SSL Corporation,C=US
      issuer:  CN=SSL.com TLS Transit ECC CA R2,O=SSL Corporation,C=US
      expires: 2035-05-27 19:49:44+00:00
      CA:      True
  [2] CN=SSL.com TLS Transit ECC CA R2,O=SSL Corporation,C=US
      issuer:  CN=SSL.com TLS ECC Root CA 2022,O=SSL Corporation,C=US
      expires: 2037-10-17 17:02:22+00:00
      CA:      True

--pin SHA256

$ certinspect example.com --pin BE:AB:14:CF:39:67:8F:DA:...
...
Pin match:      True

$ certinspect example.com --pin AA:BB:CC
...
Pin match:      False
WARNING: fingerprint does not match the expected pin
$ echo $?
7

--servername NAME

Reach a specific server by IP (or an internal DNS name) while presenting the virtual host a load balancer routes on. The SNI hostname sent in the handshake becomes NAME, and the hostname match is checked against it instead of the connection target — handy for testing one node behind a round-robin DNS or an ingress before it is publicly resolvable.

$ certinspect 10.0.0.5 --servername api.example.com
=== 10.0.0.5 ===
Subject:        CN=api.example.com
Status:         VALID
...
Hostname match: True

SAN:
  - api.example.com

--client-cert PATH / --client-key PATH

Present a client certificate so certinspect can complete the handshake with a mutual-TLS (mTLS) endpoint — internal service meshes, API gateways or admin ports that require client authentication. Point --client-cert at a PEM file; add --client-key when the private key lives in a separate file.

$ certinspect gateway.internal --client-cert ./client.pem --client-key ./client.key
=== gateway.internal ===
Subject:        CN=gateway.internal
Status:         VALID
...

--proxy URL

Tunnel the TLS connection through an HTTP CONNECT proxy, so a host reachable only through a corporate/cloud egress proxy can still be inspected. Basic proxy auth is supported via user:pass@. Pass "$HTTPS_PROXY" to reuse the environment's proxy.

$ certinspect example.com --proxy http://proxy.corp:8080
$ certinspect example.com --proxy "$HTTPS_PROXY"

--expect-san NAME

Assert that the certificate's SAN covers one or more names, independently of the host you connected to. A missing name adds a warning and yields exit code 8. The flag is repeatable and honors wildcards (*.example.com covers api.example.com). IP-address SANs are covered too, so --expect-san 10.0.0.5 works for certificates issued to an IP. It also works with --file, so you can gate a certificate before deploying it.

$ certinspect example.com --expect-san www.example.com
...
Hostname match: True
Expected SAN:   ok

$ certinspect example.com --expect-san api.example.com
...
Expected SAN:   MISSING
WARNING: SAN does not cover 'api.example.com'
$ echo $?
8

--not-after-max N

Enforce a maximum total validity: a certificate whose lifetime exceeds N days fails with exit code 9. Use 398 to match the current CA/Browser Forum limit for publicly trusted certificates. Opt-in — without the flag the validity is only reported, never enforced. Works with --file too, so you can gate a certificate before deploying it.

$ certinspect example.com --not-after-max 398
...
Total validity: 501 days
...
Policy:         FAIL
WARNING: policy violation (total validity 501 days exceeds the 398-day maximum)
$ echo $?
9

--cab-forum

Same enforcement as --not-after-max, but the limit tracks the CA/Browser Forum schedule automatically based on today's date, so you never have to update the number as the cap shortens. The maximum lifetime drops on fixed dates:

In effect from	Maximum validity
today	398 days
2026-03-15	200 days
2027-03-15	100 days
2029-03-15	47 days

Mutually exclusive with --not-after-max. Works with --file too.

$ certinspect example.com --cab-forum
...
Total validity: 501 days
...
Policy:         FAIL
WARNING: policy violation (total validity 501 days exceeds the 200-day maximum)
$ echo $?
9

--min-key-size N

Fail (exit code 9) when the public key is smaller than N bits — e.g. reject any RSA key below 2048 bit. Opt-in.

$ certinspect example.com --min-key-size 2048
...
Key size:       1024 bit
...
Policy:         FAIL
WARNING: policy violation (key size 1024 bit is below the 2048-bit minimum)
$ echo $?
9

--fail-weak

Promote the weak-crypto warnings certinspect already emits (small key, SHA-1/MD5 signature) to a hard failure with exit code 9, so a pipeline stops on weak certificates instead of merely printing a warning.

$ certinspect example.com --fail-weak
...
WARNING: Weak key (1024 bit)
Policy:         FAIL
WARNING: policy violation (Weak key (1024 bit))
$ echo $?
9

--require-sct

Fail (exit code 9) when the certificate embeds no Signed Certificate Timestamps. Publicly-trusted certificates must be logged in Certificate Transparency logs and carry SCTs, or browsers such as Chrome distrust them. Only the SCTs embedded in the certificate are checked, not those a server may deliver over the TLS handshake or OCSP. The embedded SCT count is always shown as the SCTs row.

$ certinspect internal.example.com --require-sct
...
SCTs:           none (no Certificate Transparency)
Policy:         FAIL
WARNING: policy violation (no embedded Signed Certificate Timestamps (Certificate Transparency))
$ echo $?
9

--require-must-staple

Fail (exit code 9) when the certificate lacks the OCSP Must-Staple extension (RFC 7633). A Must-Staple certificate forces clients to reject the connection unless the server presents a stapled OCSP response, closing the OCSP soft-fail hole. Whether the extension is present is always shown as the Must-Staple row.

$ certinspect example.com --require-must-staple
...
Must-Staple:    False
Policy:         FAIL
WARNING: policy violation (missing OCSP Must-Staple extension)
$ echo $?
9

--min-tls-version VER

Fail (exit code 9) when the TLS handshake negotiates a version older than VER, so a pipeline can reject servers still speaking legacy TLS. Host targets only, as it needs a live handshake. The negotiated version is always shown as the TLS version row.

$ certinspect legacy.example.com --min-tls-version TLSv1.2
...
TLS version:    TLSv1.1
Policy:         FAIL
WARNING: policy violation (TLS version TLSv1.1 is below the required TLSv1.2)
$ echo $?
9

--input PATH

Read targets from a file (# comments allowed, - for stdin).

$ cat hosts.txt
example.com
# a comment
github.com
$ certinspect --input hosts.txt --csv
target,common_name,status,days_to_expire,valid_from,valid_until,issuer,hostname_match
example.com,example.com,VALID,64,2026-05-31 21:39:12+00:00,2026-08-29 21:41:26+00:00,Cloudflare TLS Issuing ECC CA 3,True
github.com,github.com,VALID,37,2026-05-05 00:00:00+00:00,2026-08-02 23:59:59+00:00,Sectigo Public Server Authentication CA DV E36,True

--days N

Tighten or relax the expiry warning window (EXPIRING, exit 3).

$ certinspect example.com --days 90
...
Status:         EXPIRING
...
WARNING: certificate expires in 64 days
$ echo $?
3

--critical-days N

Two-tier threshold; near-expiry escalates to CRITICAL (exit 4).

$ certinspect example.com --days 90 --critical-days 70
...
Status:         CRITICAL
...
CRITICAL: certificate expires in 64 days
$ echo $?
4

--max-days N

Show only certificates expiring within N days (display filter; the exit code still reflects every target).

$ certinspect example.com github.com --max-days 50 --csv
target,common_name,status,days_to_expire,valid_from,valid_until,issuer,hostname_match
github.com,github.com,VALID,37,2026-05-05 00:00:00+00:00,2026-08-02 23:59:59+00:00,Sectigo Public Server Authentication CA DV E36,True

--sort host|expiry

Reorder the output (soonest expiry first shown here).

$ certinspect example.com github.com --sort expiry --csv
target,common_name,status,days_to_expire,valid_from,valid_until,issuer,hostname_match
github.com,github.com,VALID,37,2026-05-05 00:00:00+00:00,2026-08-02 23:59:59+00:00,Sectigo Public Server Authentication CA DV E36,True
example.com,example.com,VALID,64,2026-05-31 21:39:12+00:00,2026-08-29 21:41:26+00:00,Cloudflare TLS Issuing ECC CA 3,True

--summary

One-line tally on stderr, counting every target before filtering.

$ certinspect example.com doesnotexist.invalid --summary --csv
error: doesnotexist.invalid: [Errno 8] nodename nor servname provided, or not known
target,common_name,status,days_to_expire,valid_from,valid_until,issuer,hostname_match
example.com,example.com,VALID,64,2026-05-31 21:39:12+00:00,2026-08-29 21:41:26+00:00,Cloudflare TLS Issuing ECC CA 3,True
summary: 1 valid · 0 expiring · 0 expired · 1 error (2 targets)

--field NAME

Print only the fields you ask for, one tab-separated line per target, so you can pull values straight into a script without a JSON tool. Repeat --field for several columns; the pseudo-field target is the inspected host and list fields (like san) are comma-joined.

$ certinspect example.com github.com --field target --field days_to_expire --field status
example.com	64	VALID
github.com	37	VALID

$ certinspect example.com --field days_to_expire
64

--exit-zero

Run every check and print the report as usual, but always exit 0 — even for expired certs or unreachable hosts. Useful when a dashboard or CI step reads the output and you don't want the process to fail.

$ certinspect expired.example.com --exit-zero
=== expired.example.com ===
Subject:        CN=expired.example.com
Status:         EXPIRED
...
$ echo $?
0

--export PATH

Save the fetched certificate as PEM and still print the report.

$ certinspect example.com --export ./fetched.pem
=== example.com ===
Subject:        CN=example.com
Status:         VALID
...
$ head -1 ./fetched.pem
-----BEGIN CERTIFICATE-----

--starttls {smtp,imap,pop3,ftp}

Upgrade a plaintext protocol to TLS before inspecting (the protocol's standard port is used unless --port is given).

$ certinspect smtp.gmail.com --starttls smtp
=== smtp.gmail.com ===
Subject:        CN=smtp.gmail.com
Status:         VALID

Issuer:         CN=WE2,O=Google Trust Services,C=US
Valid from:     2026-06-08 08:38:06+00:00
Valid until:    2026-08-31 08:38:05+00:00
Days to expiry: 65
...

--concurrency N

Inspect hosts in parallel in batch mode; the output is identical to the sequential run (order is preserved), only faster. The speedup grows with the number of hosts and their latency. Measured here on a 20-host list (the normal per-host report is sent to /dev/null to focus on wall-clock time):

$ cat hosts.txt
example.com
github.com
pypi.org
wikipedia.org
cloudflare.com
mozilla.org
python.org
djangoproject.com
debian.org
archlinux.org
rust-lang.org
nodejs.org
gitlab.com
stackoverflow.com
reddit.com
apache.org
postgresql.org
docker.com
kubernetes.io
php.net

$ time certinspect --input hosts.txt >/dev/null            # sequential (default)
real 1.35

$ time certinspect --input hosts.txt --concurrency 20 >/dev/null
real 0.32

Same 20 certificates, ~4× faster. Without the redirect you still get the usual === host === report for every target, in the original input order.

--exporter {nagios,prometheus}

Machine-readable monitoring output (full examples in Monitoring).

$ certinspect example.com --exporter nagios
OK: example.com certificate VALID (64 days to expiry) | days=64;30;0

--version

$ certinspect --version
certinspect 1.0.1

Fetch error (exit 1)

An unreachable target prints an error: line to stderr and yields exit code 1; in batch mode the other targets are still inspected.

$ certinspect doesnotexist.invalid
error: doesnotexist.invalid: [Errno 8] nodename nor servname provided, or not known
$ echo $?
1

Monitoring

Use --exporter to plug certinspect straight into a monitoring stack. Both formats report every target, including hosts that could not be reached.

nagios emits one Nagios/Icinga plugin line per target with perfdata and exits with the plugin convention (0 OK, 1 WARNING, 2 CRITICAL); an unreachable host is CRITICAL:

$ certinspect example.com expired.example.com --exporter nagios
OK: example.com certificate VALID (217 days to expiry) | days=217;30;0
CRITICAL: expired.example.com certificate EXPIRED (-3 days to expiry) | days=-3;30;0

prometheus emits textfile-collector metrics (certinspect_up, certinspect_cert_expiry_days, certinspect_cert_valid), keeping the normal worst-status exit code:

$ certinspect example.com --exporter prometheus
# HELP certinspect_up Whether the target could be inspected (1) or not (0).
# TYPE certinspect_up gauge
certinspect_up{target="example.com"} 1
# HELP certinspect_cert_expiry_days Days until the certificate expires.
# TYPE certinspect_cert_expiry_days gauge
certinspect_cert_expiry_days{target="example.com"} 217
# HELP certinspect_cert_valid Whether the certificate is within its validity window (1) or not (0).
# TYPE certinspect_cert_valid gauge
certinspect_cert_valid{target="example.com"} 1

Three further gauges appear only for the targets whose check actually ran, so a scrape never carries a misleading 0 for a check that was not requested: certinspect_hostname_match (host targets), and — with --verify — certinspect_chain_trusted and certinspect_cert_revoked (the latter only when OCSP/CRL returns a definitive answer). This lets you alert directly on chain, hostname and revocation problems without parsing text:

$ certinspect example.com --verify --exporter prometheus
# ... certinspect_up / cert_expiry_days / cert_valid as above ...
# HELP certinspect_hostname_match Whether the hostname is covered by the certificate SAN (1) or not (0).
# TYPE certinspect_hostname_match gauge
certinspect_hostname_match{target="example.com"} 1
# HELP certinspect_chain_trusted Whether the certificate chain is trusted (1) or not (0).
# TYPE certinspect_chain_trusted gauge
certinspect_chain_trusted{target="example.com"} 1
# HELP certinspect_cert_revoked Whether the certificate is revoked (1) or not (0).
# TYPE certinspect_cert_revoked gauge
certinspect_cert_revoked{target="example.com"} 0

Exit codes

Designed for automation (cron, CI, monitoring scripts). In batch mode the worst code across all targets is returned.

Code	Meaning
0	Valid certificate
1	Runtime error (network, file, parse)
2	Command-line usage error
3	Expiring within the --days threshold
4	Expired, not yet valid, or with invalid dates
5	Hostname does not match the certificate
6	Chain not trusted or revoked (--verify)
7	Fingerprint does not match --pin
8	Expected SAN missing (--expect-san)
9	Policy violation (--not-after-max/--cab-forum, --min-key-size, --fail-weak, --require-sct, --require-must-staple, --min-tls-version)

Example in a script:

certinspect yoursite.com --days 21
case $? in
  0) ;;                                        # all good
  3) echo "Expiring" | mail -s "Warning" [e-mail] ;;
  4) echo "Expired"  | mail -s "Urgent"  [e-mail] ;;
  5) echo "Bad host" | mail -s "Urgent"  [e-mail] ;;
  *) echo "Check failed" ;;
esac

Recipes

A few one-liners for the terminally curious.

# Sort a whole fleet by soonest expiry, JSON straight into jq
certinspect --input fleet.txt --concurrency 20 --json \
  | jq -r 'sort_by(.days_to_expire)[] | "\(.days_to_expire)d  \(.subject)"'

# Fail a CI job if anything expires within 14 days (exit 3) or worse
certinspect --input fleet.txt --days 14 --quiet || exit 1

# Gate a deploy: fail (exit 8) unless the new cert covers every required name
certinspect --file ./new-cert.pem \
  --expect-san example.com --expect-san www.example.com --expect-san api.example.com

# Check a single node behind a load balancer by IP, validating the vhost
certinspect 10.0.0.5 --servername api.example.com --verify

# Grab just the SHA-256 fingerprint to pin it later
certinspect example.com --json | jq -r '.[0].fingerprint_sha256'

# Daily cron: refresh Prometheus textfile metrics for node_exporter
certinspect --input fleet.txt --concurrency 20 --exporter prometheus \
  > /var/lib/node_exporter/textfile/certinspect.prom

# Nightly email digest of everything expiring within 30 days
certinspect --input fleet.txt --max-days 30 --sort expiry --summary \
  | mail -s "Certs expiring soon" [e-mail]

Changelog

See CHANGELOG.md for the release history.

Development

# Tests
pytest

# Lint and formatting (Ruff)
ruff check src tests
ruff format src tests

Support

If certinspect is useful to you, the best ways to support it are:

• Star the repo to help others discover it
• Open an issue for bugs or ideas
• Send a pull request
• Share it with others who manage TLS certificates

License

MIT — see LICENSE.