https://github.com/globalsign/certlint
X.509 certificate linter, written in Go
https://github.com/globalsign/certlint
asn1 certificate go golang linter pki x509
Last synced: 3 months ago
JSON representation
X.509 certificate linter, written in Go
- Host: GitHub
- URL: https://github.com/globalsign/certlint
- Owner: globalsign
- License: apache-2.0
- Archived: true
- Created: 2016-10-14T15:48:37.000Z (almost 9 years ago)
- Default Branch: master
- Last Pushed: 2019-01-05T14:36:36.000Z (over 6 years ago)
- Last Synced: 2024-11-20T14:47:46.398Z (11 months ago)
- Topics: asn1, certificate, go, golang, linter, pki, x509
- Language: Go
- Homepage:
- Size: 178 KB
- Stars: 59
- Watchers: 10
- Forks: 15
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE.txt
Awesome Lists containing this project
README
# certlint
[](https://travis-ci.org/globalsign/certlint)
[](https://goreportcard.com/report/github.com/globalsign/certlint)
[](http://codecov.io/github.com/globalsign/certlint?branch=master)
[](https://godoc.org/github.com/globalsign/certlint)
X.509 certificate linter written in Go
#### General
This package is a work in progress.
Please keep in mind that:
- This is an early release and may contain bugs or false reports
- Not all checks have been fully implemented or verified against the standard
- CLI flag, APIs and CSV export are subject to change
Code contributions and tests are highly welcome!
#### Installation
To install from source, just run:
```bash
go get -u github.com/globalsign/certlint
go install github.com/globalsign/certlint
```
#### CLI: Usage
The 'certlint' command line utility included with this package can be used to test a single certificate or a large pem container to bulk test millions of certificates. The command is used to test the linter on a large number of certificates but could use fresh up to reduce code complexity.
```
Usage of ./certlint:
-bulk string
Bulk certificates file
-cert string
Certificate file
-errlevel string
Exit non-zero for Errors at this level (default "error")
-expired
Test expired certificates
-help
Show this help
-include
Include certificates in report
-issuer string
Certificate file
-pprof
Generate pprof profile
-report string
Report filename (default "report.csv")
-revoked
Check if certificates are revoked
```
##### CLI: One certificate
```bash
$ certlint -cert certificate.pem
```
##### CLI: One certificate, exiting non-zero for Warning and above
```bash
$ certlint -errlevel warning -cert certificate.pem
```
##### CLI: A series of PEM encoded certificates
```bash
$ certlint -bulk largestore.pem
```
##### CLI: Testing expired certificates
```bash
$ certlint -expired -bulk largestore.pem
```
##### API: Usage
Import one or all of these packages:
```go
import "github.com/globalsign/certlint/asn1"
import "github.com/globalsign/certlint/certdata"
import "github.com/globalsign/certlint/checks"
```
You can import all available checks:
```go
_ "github.com/globalsign/certlint/checks/extensions/all"
_ "github.com/globalsign/certlint/checks/certificate/all"
```
Or you can just import a restricted set:
```go
// Check for certificate (ext) KeyUsage extension
_ "github.com/globalsign/certlint/checks/extensions/extkeyusage"
_ "github.com/globalsign/certlint/checks/extensions/keyusage"
// Also check the parsed certificate (ext) keyusage content
_ "github.com/globalsign/certlint/checks/certificate/extkeyusage"
_ "github.com/globalsign/certlint/checks/certificate/keyusage"
```
##### API: Check ASN.1 value formatting
```go
al := new(asn1.Linter)
e := al.CheckStruct(der)
if e != nil {
for _, err := range e.List() {
fmt.Println(err)
}
}
```
##### API: Check certificate details
```go
d, err := certdata.Load(der)
if err == nil {
e := checks.Certificate.Check(d)
if e != nil {
for _, err := range e.List() {
fmt.Println(err)
}
}
}
```