ssl-cert-toolkit

SSL certificate toolkit

Use openssl on this host to inspect certificates, verify key/cert/CSR pairing, generate CSRs, convert common formats, and run simple validation.

Out of scope: cloud purchase/upload/deploy APIs, silently changing the system trust store, submitting CA requests for the user.

Rules

1. Clarify intent first: inspect / match / generate CSR / convert / verify—ask if unclear.
2. Confirm before writing files: confirm output paths; do not overwrite existing files unless asked.
3. Protect private keys: never paste key material into chat; suggest mode 0600; do not log key bodies.
4. Dependency: require openssl (command -v openssl). keytool only for JKS.
5. Stop when enough: after match/inspect succeeds, do not “optimize” unrelated files.
6. Fail closed on match: if OpenSSL cannot parse an input, report that—never treat empty digests as MATCH.

Capabilities

Intent	Example asks
Inspect	validity dates, SAN, issuer
Match	are cert and key a pair; does CSR match
Generate CSR	create CSR to get a signed cert
Convert	PEM ↔ PFX/P12, split chain
Verify	chain OK, expired or not

Inspect

openssl version
openssl x509 -in <cert.pem> -noout -subject -issuer -dates -ext subjectAltName 2>/dev/null
openssl x509 -in <cert.pem> -noout -text | head -80

For PFX, ask for the password; prefer -passin env:CERT_PASS over putting secrets on the command line:

openssl pkcs12 -in <file.pfx> -nokeys -clcerts -passin env:CERT_PASS

Match check (cert / key / CSR)

Compare public keys (preferred) or RSA moduli. Each openssl extract must succeed and produce non-empty output before comparing:

openssl x509 -in <cert.pem> -noout -pubkey | openssl md5
openssl pkey -in <key.pem> -pubout | openssl md5
openssl req -in <csr.pem> -noout -pubkey | openssl md5   # if CSR given

Parse failure or empty digest → not MATCH. Equal non-empty digests → MATCH.
Optional: openssl req -in <csr.pem> -noout -verify (CSR signature; separate from key match).