cert-parse

What this skill does

Accepts an X.509 certificate file or PEM text and uses openssl x509 to parse the Subject, Issuer, SAN, validity period, public key info, and extension fields. If a CA bundle is provided, performs chain verification with openssl verify, and automatically checks for common issues such as weak keys, expiry, and self-signing.

When to use

• Inspecting a server certificate before or after deployment
• Debugging certificate chain errors (e.g., UNABLE_TO_GET_ISSUER_CERT)
• Checking certificate-related vulnerabilities (weak keys, wildcard misuse, etc.) during bug bounty or penetration testing

Prerequisites

• openssl installed (built into Linux/macOS)
• Certificate file (PEM/DER) or PEM text
• CA bundle file for chain verification (optional)

Inputs

Variable	Description	Example
CERT_INPUT	PEM file path or remote host	/path/to/cert.pem or example.com:443
CA_BUNDLE	(optional) CA bundle file path	/etc/ssl/certs/ca-certificates.crt

Workflow

Step 1: Extract PEM from certificate source

CERT_INPUT="/path/to/cert.pem"  # or "example.com:443"
WORK_CERT="/tmp/target_cert.pem"

# Determine whether input is a file or host:port
if [ -f "$CERT_INPUT" ]; then
  echo "=== Loading certificate from file: $CERT_INPUT ==="
  # Auto-convert DER format to PEM
  if openssl x509 -in "$CERT_INPUT" -noout 2>/dev/null; then
    cp "$CERT_INPUT" "$WORK_CERT"
    echo "PEM format confirmed"
  else
    openssl x509 -in "$CERT_INPUT" -inform DER -out "$WORK_CERT" 2>/dev/null && \
      echo "DER -> PEM conversion complete" || echo "Certificate format parsing failed"
  fi
else
  echo "=== Fetching certificate from remote host: $CERT_INPUT ==="
  HOST=$(echo "$CERT_INPUT" | cut -d: -f1)
  PORT=$(echo "$CERT_INPUT" | cut -d: -f2)
  PORT=${PORT:-443}
  echo | openssl s_client \
    -connect "${HOST}:${PORT}" \
    -servername "$HOST" \
    2>/dev/null | openssl x509 -out "$WORK_CERT"
  echo "Remote certificate saved: $WORK_CERT"
fi