@chengyixu/certinfo 1.0.0

package/index.js

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+
+// certinfo — zero-dependency SSL/TLS certificate inspector
+// Usage: certinfo example.com[:443] [--json|-j]
+
+const tls = require("tls");
+const net = require("net");
+const crypto = require("crypto");
+
+const args = process.argv.slice(2);
+const jsonOut = args.includes("--json") || args.includes("-j");
+const hostArg = args.find((a) => !a.startsWith("-"));
+
+if (!hostArg) {
+  console.error("Usage: certinfo <host[:port]> [--json|-j]");
+  console.error("  certinfo example.com");
+  console.error("  certinfo example.com:8443 --json");
+  process.exit(1);
+}
+
+let hostname, port;
+if (hostArg.includes(":")) {
+  const parts = hostArg.split(":");
+  hostname = parts[0];
+  port = parseInt(parts[1], 10);
+} else {
+  hostname = hostArg;
+  port = 443;
+}
+
+if (!hostname || isNaN(port)) {
+  console.error("Error: invalid host:port format");
+  process.exit(1);
+}
+
+function pad(n) {
+  return String(n).padStart(2, "0");
+}
+
+function fmtDate(d) {
+  const y = d.getFullYear();
+  const m = pad(d.getMonth() + 1);
+  const day = pad(d.getDate());
+  const h = pad(d.getHours());
+  const min = pad(d.getMinutes());
+  const sec = pad(d.getSeconds());
+  return `${y}-${m}-${day} ${h}:${min}:${sec} GMT`;
+}
+
+function daysUntil(d) {
+  return Math.ceil((d.getTime() - Date.now()) / 86400000);
+}
+
+function parseSANs(altName) {
+  if (!altName) return [];
+  return altName.split(", ").map((s) => s.replace(/^DNS:/, "").replace(/^IP Address:/, "").trim());
+}
+
+function keyLabel(x509) {
+  const pk = x509.publicKey;
+  const type = pk.asymmetricKeyType || "unknown";
+  const det = pk.asymmetricKeyDetails || {};
+  if (type === "ec") {
+    return `EC (${det.namedCurve || "unknown"})`;
+  }
+  if (type === "rsa" || type === "rsa-pss") {
+    return `RSA ${det.modulusLength || ""} bits`;
+  }
+  if (det.modulusLength) return `${type} ${det.modulusLength} bits`;
+  return type;
+}
+
+function parseInfoAccess(ia) {
+  if (!ia) return [];
+  // ia is a string like "OCSP - URI:http://..."
+  return ia.split("\n").filter(Boolean).map((line) => line.trim());
+}
+
+function parseKeyUsage(ku) {
+  if (!ku) return [];
+  return ku;
+}
+
+const KNOWN_KEY_USAGE = {
+  "1.3.6.1.5.5.7.3.1": "TLS Web Server Authentication",
+  "1.3.6.1.5.5.7.3.2": "TLS Web Client Authentication",
+  "1.3.6.1.5.5.7.3.3": "Code Signing",
+  "1.3.6.1.5.5.7.3.4": "Email Protection",
+  "1.3.6.1.5.5.7.3.8": "Time Stamping",
+  "1.3.6.1.5.5.7.3.9": "OCSP Signing",
+};
+
+function humanKeyUsage(oid) {
+  return KNOWN_KEY_USAGE[oid] || oid;
+}
+
+const socket = net.createConnection(
+  { host: hostname, port, servername: hostname },
+  () => {
+    const tlsSocket = tls.connect(
+      {
+        socket,
+        servername: hostname,
+        rejectUnauthorized: false,
+      },
+      () => {
+        const raw = tlsSocket.getPeerCertificate(false);
+        let x509;
+        try {
+          x509 = new crypto.X509Certificate(raw.raw);
+        } catch {
+          console.error("Error: failed to parse certificate");
+          process.exit(1);
+        }
+
+        const expires = new Date(x509.validTo);
+        const validFrom = new Date(x509.validFrom);
+        const daysLeft = daysUntil(expires);
+
+        if (jsonOut) {
+          const result = {
+            hostname,
+            port,
+            subject: x509.subject,
+            issuer: x509.issuer,
+            validity: {
+              from: x509.validFrom,
+              to: x509.validTo,
+              days_left: daysLeft,
+              expired: daysLeft <= 0,
+              expiring_soon: daysLeft > 0 && daysLeft <= 30,
+            },
+            key: keyLabel(x509),
+            signature_algorithm: x509.signatureAlgorithm || "unknown",
+            fingerprint_sha256: x509.fingerprint256 || "",
+            fingerprint_sha1: x509.fingerprint || "",
+            san: parseSANs(x509.subjectAltName),
+            serial_number: x509.serialNumber ? `0x${x509.serialNumber}` : "",
+            info_access: parseInfoAccess(x509.infoAccess),
+            key_usage: parseKeyUsage(x509.extKeyUsage),
+          };
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          let statusIcon, statusText;
+          if (daysLeft <= 0) {
+            statusIcon = "\x1b[31mEXPIRED\x1b[0m";
+            statusText = "\x1b[31mEXPIRED\x1b[0m";
+          } else if (daysLeft <= 15) {
+            statusIcon = "\x1b[31mCRITICAL\x1b[0m";
+            statusText = `\x1b[31m${daysLeft} days left\x1b[0m`;
+          } else if (daysLeft <= 30) {
+            statusIcon = "\x1b[33mWARN\x1b[0m";
+            statusText = `\x1b[33m${daysLeft} days left\x1b[0m`;
+          } else {
+            statusIcon = "\x1b[32mOK\x1b[0m";
+            statusText = `\x1b[32m${daysLeft} days left\x1b[0m`;
+          }
+
+          const bar = "-".repeat(54);
+
+          console.log("");
+          console.log(`  SSL/TLS Certificate — ${hostname}:${port}  ${statusIcon}`);
+          console.log("  " + bar);
+          console.log(`  Subject:          ${x509.subject}`);
+          console.log(`  Issuer:           ${x509.issuer}`);
+          console.log(`  Valid from:       ${x509.validFrom}`);
+          console.log(`  Valid until:      ${x509.validTo}`);
+          console.log(`  Status:           ${statusText}`);
+          console.log(`  Key:              ${keyLabel(x509)}`);
+          console.log(`  Signature:        ${x509.signatureAlgorithm || "unknown"}`);
+          console.log(`  SHA-256:          ${x509.fingerprint256 || ""}`);
+          console.log(`  SHA-1:            ${x509.fingerprint || ""}`);
+          console.log(`  Serial:           ${x509.serialNumber ? "0x" + x509.serialNumber : ""}`);
+
+          const sans = parseSANs(x509.subjectAltName);
+          if (sans.length > 0) {
+            console.log(`  SANs (${sans.length}): ${sans.slice(0, 5).join(", ")}${sans.length > 5 ? " ..." : ""}`);
+            if (sans.length > 5) {
+              sans.slice(5).forEach((s) => console.log(`                    ${s}`));
+            }
+          }
+
+          const ia = parseInfoAccess(x509.infoAccess);
+          if (ia.length > 0) {
+            console.log("");
+            console.log("  Info Access:");
+            ia.forEach((line) => console.log(`    ${line}`));
+          }
+
+          const ku = parseKeyUsage(x509.extKeyUsage);
+          if (ku.length > 0) {
+            console.log("");
+            console.log("  Extended Key Usage:");
+            ku.forEach((oid) => console.log(`    ${oid}  (${humanKeyUsage(oid)})`));
+          }
+
+          // Chain
+          const cert = tlsSocket.getPeerCertificate(true);
+          if (cert && cert.issuerCertificate && cert.issuerCertificate !== cert) {
+            console.log("");
+            console.log("  Certificate Chain:");
+            let chain = cert;
+            let depth = 0;
+            while (chain) {
+              const label = chain.issuerCertificate === chain ? " (self-signed)" : "";
+              console.log(`    ${depth}: ${chain.subject ? chain.subject.CN || chain.subject : "?"}${label}`);
+              if (chain === chain.issuerCertificate) break;
+              chain = chain.issuerCertificate;
+              depth++;
+            }
+          }
+
+          console.log("");
+        }
+
+        tlsSocket.end();
+      },
+    );
+
+    tlsSocket.on("error", (err) => {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    });
+
+    tlsSocket.setTimeout(10000);
+    tlsSocket.on("timeout", () => {
+      console.error("Error: Connection timed out");
+      process.exit(1);
+    });
+  },
+);
+
+socket.setTimeout(10000);
+socket.on("error", (err) => {
+  console.error(`Error: ${err.message}`);
+  process.exit(1);
+});
+
+socket.on("timeout", () => {
+  console.error("Error: Connection timed out");
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@chengyixu/certinfo",
+  "version": "1.0.0",
+  "description": "Zero-dependency CLI to inspect SSL/TLS certificate details from any host",
+  "main": "index.js",
+  "bin": {
+    "certinfo": "./index.js"
+  },
+  "files": [
+    "index.js"
+  ],
+  "keywords": [
+    "ssl",
+    "tls",
+    "certificate",
+    "cli",
+    "security",
+    "https",
+    "expiry",
+    "x509"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/chengyixu/certinfo"
+  },
+  "engines": {
+    "node": ">=16"
+  }
+}