The Lupaxa Security Toolbox
Part of The Lupaxa Project

lupaxa-certtool

A clean, modern, fully-typed Python CLI and library for generating self-signed X.509 certificates, certificate signing requests (CSRs), and private keys.

Built for automation, reproducibility, and bulk-generation workflows used by The Lupaxa Project.

Features

Generate self-signed certificates, private keys, and CSRs
Generate from:
- JSON config file
- Directory of config files (bulk mode)
- Pure command-line flags
Output:
- To stdout
- Or into an output directory, with one folder per certificate
Supports:
- RSA key generation
- SHA-256 / SHA-384 / SHA-512 digests
- Validity period configuration
- Optional private key encryption with passphrase
- Subject Alternative Names (SANs) via JSON or CLI
Includes:
- --generate-example to produce a full example JSON config
- --inspect-cert to analyze existing PEM certificates
- --validate-config to validate config files before use
Fully typed, linted, formatted, and tested
MkDocs documentation included

Installation

From PyPI

pip install lupaxa-certtool

From source (development mode)

pip install -e ".[dev]"

Usage

Basic self-signed certificate from CLI

certtool \
  --countryName UK \
  --stateOrProvinceName Somerset \
  --localityName Glastonbury \
  --organizationName "Lupaxa Project" \
  --commonName "dev.internal"

Using JSON Configuration

Generate an example config

certtool --generate-example --example-file dev-internal-cert.json

Use a JSON config file

certtool --config dev-internal-cert.json

Use a directory of configs (bulk mode)

certtool --config-dir configs/

Output Directory Structure

If you pass:

certtool --config-dir configs/ --output-dir output/

You get:

output/
├── dev.internal/
│   ├── cert.pem
│   ├── csr.pem
│   └── key.pem
└── api.internal/
    ├── cert.pem
    ├── csr.pem
    └── key.pem

Each certificate gets its own folder to prevent overwriting.

Private Key Encryption

JSON

{
  "passphrase": "your-secret-here"
}

CLI (overrides JSON)

certtool --config dev-internal-cert.json --passphrase "some-secret"

Inspect a Certificate

certtool --inspect-cert output/dev.interal/cert.pem

Documentation

The project includes MkDocs documentation.

Online documentation:

Documentation

Full documentation is available in the docs/ directory or served locally:

Serve docs locally

mkdocs serve

Then open the local URL printed by MkDocs in your browser.

Development

Clone the repository and install dev dependencies:

pip install -e ".[dev]"

Useful make targets:

make test        # run tests
make type        # type checking (mypy)
make check-style # lint + format + type
make check-all   # run tests, coverage, and audit

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

lupaxa_certtool-0.1.4.tar.gz (19.8 kB view details)

Uploaded Aug 20, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

lupaxa_certtool-0.1.4-py3-none-any.whl (22.4 kB view details)

Uploaded Aug 20, 2026 Python 3

File details

Details for the file lupaxa_certtool-0.1.4.tar.gz.

File metadata

Download URL: lupaxa_certtool-0.1.4.tar.gz
Upload date: Aug 20, 2026
Size: 19.8 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for lupaxa_certtool-0.1.4.tar.gz
Algorithm	Hash digest
SHA256	`ee5df7b655ce62f538ae1f653807dc1159d058fd145495e3de5d286124082d5d`
MD5	`875ac27b6f8756431f6d815d028cad33`
BLAKE2b-256	`f12acdf58a4940648a6121f6dcb4a593ab8b6dfaf6e8a09b5b8c68e3cdd3254f`

See more details on using hashes here.

Provenance

The following attestation bundles were made for lupaxa_certtool-0.1.4.tar.gz:

Publisher: generate-release.yml on lupaxa-security-toolbox/certtool

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: lupaxa_certtool-0.1.4.tar.gz
- Subject digest: ee5df7b655ce62f538ae1f653807dc1159d058fd145495e3de5d286124082d5d
- Sigstore transparency entry: 2533711486
- Sigstore integration time: Aug 20, 2026
Source repository:
- Permalink: lupaxa-security-toolbox/certtool@0078143fa951b7b8b486117420c2ffcd6acb19c1
- Branch / Tag: refs/tags/v0.1.4
- Owner: https://github.com/lupaxa-security-toolbox
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: generate-release.yml@0078143fa951b7b8b486117420c2ffcd6acb19c1
- Trigger Event: push

File details

Details for the file lupaxa_certtool-0.1.4-py3-none-any.whl.

File metadata

Download URL: lupaxa_certtool-0.1.4-py3-none-any.whl
Upload date: Aug 20, 2026
Size: 22.4 kB
Tags: Python 3
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for lupaxa_certtool-0.1.4-py3-none-any.whl
Algorithm	Hash digest
SHA256	`14c262788378ee861dcbc1a8f4d1b339996a8b3bf0970c07ee59c6ba70b3c478`
MD5	`f050e834b089a3b8833e5210835ad4f7`
BLAKE2b-256	`9614bfbb2d4783091df00130d97abec63322ae508ac8c045b3c7d1e35dc89702`

See more details on using hashes here.

Provenance

The following attestation bundles were made for lupaxa_certtool-0.1.4-py3-none-any.whl:

Publisher: generate-release.yml on lupaxa-security-toolbox/certtool

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: lupaxa_certtool-0.1.4-py3-none-any.whl
- Subject digest: 14c262788378ee861dcbc1a8f4d1b339996a8b3bf0970c07ee59c6ba70b3c478
- Sigstore transparency entry: 2533711566
- Sigstore integration time: Aug 20, 2026
Source repository:
- Permalink: lupaxa-security-toolbox/certtool@0078143fa951b7b8b486117420c2ffcd6acb19c1
- Branch / Tag: refs/tags/v0.1.4
- Owner: https://github.com/lupaxa-security-toolbox
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: generate-release.yml@0078143fa951b7b8b486117420c2ffcd6acb19c1
- Trigger Event: push

Release history Release notifications | RSS feed

0.1.5

Aug 24, 2026 2 files

This release

0.1.4 This release

Aug 20, 2026 2 files

0.1.3

Aug 20, 2026 2 files

0.1.1

Nov 21, 2025 2 files

0.1.0

Nov 21, 2025 2 files

lupaxa-certtool 0.1.4

The Lupaxa Security Toolbox Part of The Lupaxa Project

lupaxa-certtool

Features

Installation

From PyPI

From source (development mode)

Usage

Basic self-signed certificate from CLI

Using JSON Configuration

Generate an example config

Use a JSON config file

Use a directory of configs (bulk mode)

Output Directory Structure

Private Key Encryption

JSON

CLI (overrides JSON)

Inspect a Certificate

Documentation

Online documentation:

Serve docs locally

Development

Project links

Key dates

1 maintainer

Credits

GitHub Statistics

License

Requires

Provides Extra

Tags

Classifiers

Download files

Source Distribution

Built Distribution

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

Release history Release notifications | RSS feed

The Lupaxa Security Toolbox
Part of The Lupaxa Project