~/projects/sslknife

sslknife

The swiss knife for TLS, X.509, PKI and SSH. Inspect, lint, convert, scan and run a private CA. A single static binary, no OpenSSL.

ver v0.3.0 lang Go lic MIT macOSLinuxWindows

Source Download

quickstart — zsh

brew install matusso/tap/sslknife

sslknife cert inspect github.com:443

sslknife cert expires cert.pem --check 30d

sslknife convert keystore.jks --to pkcs12

sslknife tls scan example.com

sslknife is built for hackers, nerds, developers and system engineers who live in a terminal. One tool replaces the openssl incantations you keep looking up, the keytool you never remember, and the scripts that check whether a certificate is about to expire.

Inspect anythingFiles, bundles, keystores or a live host:port. See what a server actually presents.

Private CARoot, intermediate and leaf certificates in three commands, stored in your vault.

Convert without keytoolPEM, DER, PKCS#12 and Java JKS, from any format to any other.

TLS scannerProtocols, ciphers, chain and findings for any endpoint.

CT watchAlerts on unexpected certificate issuance for your domains via Certificate Transparency.

Encrypted vault + web UIA local encrypted inventory with Touch ID unlock on macOS and an optional web dashboard.

Install

Works on macOS and Linux:

brew install matusso/tap/sslknife
brew upgrade sslknife        # later, to get the newest release

Always fetches the latest release:

VERSION=$(curl -fsSL https://api.github.com/repos/matusso/sslknife/releases/latest | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')
ARCH=$(dpkg --print-architecture)
curl -fLO "https://github.com/matusso/sslknife/releases/download/v${VERSION}/sslknife_${VERSION}_${ARCH}.deb"
sudo apt install "./sslknife_${VERSION}_${ARCH}.deb"

VERSION=$(curl -fsSL https://api.github.com/repos/matusso/sslknife/releases/latest | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')
sudo dnf install "https://github.com/matusso/sslknife/releases/download/v${VERSION}/sslknife-${VERSION}-1.$(uname -m).rpm"

Both packages install /usr/bin/sslknife with bash, zsh and fish completions.

Downloads

Release archives come with SBOMs and a Sigstore-signed checksum file.

MAC macOS · Apple Siliconsslknife_0.3.0_darwin_arm64.tar.gz MAC macOS · Intelsslknife_0.3.0_darwin_amd64.tar.gz LNX Linux · amd64sslknife_0.3.0_linux_amd64.tar.gz LNX Linux · arm64sslknife_0.3.0_linux_arm64.tar.gz DEB Debian / Ubuntu · amd64sslknife_0.3.0_amd64.deb DEB Debian / Ubuntu · arm64sslknife_0.3.0_arm64.deb RPM Fedora / RHEL · x86_64sslknife-0.3.0-1.x86_64.rpm RPM Fedora / RHEL · aarch64sslknife-0.3.0-1.aarch64.rpm WIN Windows · amd64sslknife_0.3.0_windows_amd64.zip

release v0.3.0 · verify with checksums.txt · all releases →

Usage

Working with files and remote hosts needs no setup:

sslknife cert inspect fullchain.pem            # what is in this file?
sslknife cert inspect github.com:443           # what does this server present?
sslknife cert expires cert.pem --check 30d     # exit 5 if it expires within 30 days
sslknife tls scan example.com                  # protocols, ciphers, chain, findings
sslknife convert keystore.jks --to pkcs12      # any format to any other
sslknife ssh inspect ~/.ssh/id_ed25519.pub

Keep certificates in an encrypted vault

sslknife init                                  # asks for a vault password
sslknife init --touch-id                       # macOS: unlock with Touch ID or Apple Watch
sslknife cert import fullchain.pem --name api-prod --tag production
sslknife cert expiring --within 90d
sslknife ct watch '*.example.com'              # alert on unexpected issuance

Run a small private CA

sslknife cert create --type root-ca --cn "Example Root CA" --store --name root
sslknife cert create --type intermediate-ca --cn "Example Issuing CA" --ca root --store --name issuing
sslknife cert create --cn api.example.com --ca issuing --validity 90d

Web UI

sslknife server                                # prints https://127.0.0.1:8443/?token=…

Every command has examples in --help. Add --json or --yaml for scripting.