certkit

Mar 9, 2026

Changes in this version

+ var ErrChainVerificationFailed = errors.New("chain verification failed")

+ func FormatConnectStatusLines(r *ConnectResult) string

+ func FormatSSHProbeResult(r *SSHProbeResult) string

+ func FormatSSHRatingLine(r *SSHProbeResult) string

type ChainDiagnostic

+ func DiagnoseCipherScanPolicy(r *CipherScanResult) []ChainDiagnostic

+ func DiagnoseSSHProbe(r *SSHProbeResult) []ChainDiagnostic

type CipherRating

+ func RateSSHAlgorithms(r *SSHProbeResult) CipherRating

type CipherScanResult

+ Policy SecurityPolicy

type ConnectResult

+ Policy SecurityPolicy

type ConnectTLSInput

+ Policy SecurityPolicy

+ type SSHProbeInput struct

+ Host string

+ Policy SecurityPolicy

+ Port string

+ type SSHProbeResult struct

+ Banner string

+ CiphersClientToServer []string

+ CiphersServerToClient []string

+ CompressionClientToServer []string

+ CompressionServerToClient []string

+ Diagnostics []ChainDiagnostic

+ Host string

+ HostKeyAlgorithms []string

+ KeyExchangeAlgorithms []string

+ KeyExchangeExtensions []string

+ MACsClientToServer []string

+ MACsServerToClient []string

+ OverallRating CipherRating

+ Policy SecurityPolicy

+ Port string

+ Protocol string

+ SoftwareVersion string

+ func ProbeSSH(ctx context.Context, input SSHProbeInput) (*SSHProbeResult, error)

type ScanCipherSuitesInput

+ Policy SecurityPolicy

+ type SecurityPolicy string

+ const SecurityPolicyFIPS1402

+ const SecurityPolicyFIPS1403

+ const SecurityPolicyNone

+ func (p SecurityPolicy) DisplayName() string

+ func (p SecurityPolicy) Enabled() bool

Mar 2, 2026

Changes in this version

+ var ErrCAKeyMismatch = errors.New("CA key does not match CA certificate")

+ var ErrCRLTooLarge = errors.New("CRL data exceeds max size")

+ var ErrEmptySANExtension = errors.New("no SAN entries provided")

+ var ErrUnknownOtherNameType = errors.New("unknown othername type")

+ func CRLContainsCertificate(crl *x509.RevocationList, cert *x509.Certificate) bool

+ func CheckCT(input CheckCTInput) (*CTResult, []ChainDiagnostic)

+ func CollectCertificateSANs(cert *x509.Certificate) []string

+ func CreateSelfSigned(input SelfSignedInput) (*x509.Certificate, error)

+ func EncodeJKSEntries(entries []JKSEntry, password string) ([]byte, error)

+ func FetchCRL(ctx context.Context, input FetchCRLInput) ([]byte, error)

+ func FormatCRLInfo(info *CRLInfo) string

+ func FormatCRLLine(r *CRLCheckResult) string

+ func FormatCRLStatusLine(prefix string, r *CRLCheckResult) string

+ func FormatCTLine(r *CTResult) string

+ func FormatCipherRatingLine(r *CipherScanResult) string

+ func FormatCipherScanResult(r *CipherScanResult) string

+ func FormatConnectResult(r *ConnectResult) string

+ func FormatDNFromRaw(raw []byte, fallback pkix.Name) string

+ func FormatOCSPLine(r *OCSPResult) string

+ func FormatOCSPResult(r *OCSPResult) string

+ func FormatOCSPStatusLine(prefix string, r *OCSPResult) string

+ func FormatSerialNumber(serial *big.Int) string

+ func MarshalSANExtension(input MarshalSANExtensionInput) (pkix.Extension, error)

+ func ParseCRL(data []byte) (*x509.RevocationList, error)

+ func ParsePEMPrivateKeys(pemData []byte, passwords []string) ([]crypto.PrivateKey, error)

+ func ReadCRLFile(path string) ([]byte, error)

+ func ResolveOtherNameOID(s string) (asn1.ObjectIdentifier, error)

+ func SelectIssuerCertificate(cert *x509.Certificate, candidates []*x509.Certificate) *x509.Certificate

+ func SignCSR(input SignCSRInput) (*x509.Certificate, error)

+ func SortDiagnostics(diags []ChainDiagnostic)

+ func ValidateAIAURLWithOptions(ctx context.Context, input ValidateAIAURLInput) error

+ type BundleInput struct

+ Leaf *x509.Certificate

+ Options BundleOptions

type BundleOptions

+ AllowPrivateNetworks bool

+ type CRLCheckResult struct

+ Detail string

+ Status string

+ URL string

+ func CheckLeafCRL(ctx context.Context, input CheckLeafCRLInput) *CRLCheckResult

+ type CRLInfo struct

+ AKI string

+ CRLNumber string

+ Issuer string

+ NextUpdate string

+ NumEntries int

+ SignatureAlgorithm string

+ ThisUpdate string

+ func CRLInfoFromList(crl *x509.RevocationList) *CRLInfo

type CSRTemplate

+ OtherNames []CSRTemplateOtherName

+ type CSRTemplateOtherName struct

+ Type string

+ Value string

+ type CTResult struct

+ Invalid int

+ SCTs []SCTInfo

+ Status string

+ Total int

+ Unavailable int

+ UnknownLog int

+ Valid int

+ type ChainDiagnostic struct

+ Check string

+ Detail string

+ Status string

+ func DiagnoseCipherScan(r *CipherScanResult) []ChainDiagnostic

+ func DiagnoseConnectChain(input DiagnoseConnectChainInput) []ChainDiagnostic

+ func DiagnoseNegotiatedCipher(protocol, cipherSuite string) []ChainDiagnostic

+ func DiagnoseVerifyError(verifyErr error) []ChainDiagnostic

+ type CheckCTInput struct

+ Chain []*x509.Certificate

+ LogList []byte

+ TLSSCTs [][]byte

+ type CheckLeafCRLInput struct

+ AllowPrivateNetworks bool

+ Issuer *x509.Certificate

+ Leaf *x509.Certificate

+ Timeout time.Duration

+ type CheckOCSPInput struct

+ AllowPrivateNetworks bool

+ Cert *x509.Certificate

+ Issuer *x509.Certificate

+ type CipherProbeResult struct

+ ID uint16

+ KeyExchange string

+ Name string

+ Rating CipherRating

+ Version string

+ type CipherRating string

+ const CipherRatingGood

+ const CipherRatingWeak

+ func RateCipherSuite(cipherID uint16, tlsVersion uint16) CipherRating

+ type CipherScanResult struct

+ Ciphers []CipherProbeResult

+ KeyExchanges []KeyExchangeProbeResult

+ OverallRating CipherRating

+ QUICCiphers []CipherProbeResult

+ QUICProbed bool

+ SupportedVersions []string

+ func ScanCipherSuites(ctx context.Context, input ScanCipherSuitesInput) (*CipherScanResult, error)

+ type ClientAuthInfo struct

+ AcceptableCAs []string

+ Requested bool

+ SignatureSchemes []string

+ type ConnectResult struct

+ AIAFetched bool

+ ALPN string

+ CRL *CRLCheckResult

+ CT *CTResult

+ CipherScan *CipherScanResult

+ CipherSuite string

+ ClientAuth *ClientAuthInfo

+ Diagnostics []ChainDiagnostic

+ Host string

+ LegacyProbe bool

+ OCSP *OCSPResult

+ PeerChain []*x509.Certificate

+ Port string

+ Protocol string

+ ServerName string

+ TLSSCTs [][]byte

+ VerifiedChains [][]*x509.Certificate

+ VerifyError string

+ func ConnectTLS(ctx context.Context, input ConnectTLSInput) (*ConnectResult, error)

+ type ConnectTLSInput struct

+ AIATimeout time.Duration

+ AllowPrivateNetworks bool

+ CRLTimeout time.Duration

+ CheckCRL bool

+ ConnectTimeout time.Duration

+ DisableAIA bool

+ DisableOCSP bool

+ Host string

+ OCSPTimeout time.Duration

+ Port string

+ RootCAs *x509.CertPool

+ ServerName string

+ type DecodedJKSKeyEntry struct

+ Alias string

+ Chain []*x509.Certificate

+ Key crypto.PrivateKey

+ func DecodeJKSKeyEntries(data []byte, passwords []string) ([]DecodedJKSKeyEntry, []*x509.Certificate, error)

+ type DiagnoseConnectChainInput struct

+ PeerChain []*x509.Certificate

+ type FetchAIACertificatesInput struct

+ AllowPrivateNetworks bool

+ Cert *x509.Certificate

+ MaxDepth int

+ Timeout time.Duration

+ type FetchCRLInput struct

+ AllowPrivateNetworks bool

+ URL string

+ type FetchLeafFromURLInput struct

+ Timeout time.Duration

+ URL string

+ type JKSEntry struct

+ Alias string

+ CACerts []*x509.Certificate

+ Leaf *x509.Certificate

+ PrivateKey crypto.PrivateKey

+ type KeyExchangeProbeResult struct

+ ID uint16

+ Name string

+ PostQuantum bool

+ type MarshalSANExtensionInput struct

+ DNSNames []string

+ EmailAddresses []string

+ IPAddresses []net.IP

+ OtherNames []OtherNameSAN

+ URIs []*url.URL

+ type OCSPResult struct

+ Detail string

+ NextUpdate string

+ RevocationReason *string

+ RevokedAt *string

+ SerialNumber string

+ Status string

+ ThisUpdate string

+ URL string

+ func CheckOCSP(ctx context.Context, input CheckOCSPInput) (*OCSPResult, error)

+ type OtherNameSAN struct

+ OID asn1.ObjectIdentifier

+ Value string

+ type SCTInfo struct

+ Detail string

+ LogID string

+ LogName string

+ Source string

+ Status string

+ Timestamp string

+ type ScanCipherSuitesInput struct

+ Concurrency int

+ Host string

+ Port string

+ ProbeQUIC bool

+ ServerName string

+ type SelfSignedInput struct

+ Days int

+ IsCA bool

+ Signer crypto.Signer

+ Subject pkix.Name

+ type SignCSRInput struct

+ CACert *x509.Certificate

+ CAKey crypto.Signer

+ CSR *x509.CertificateRequest

+ CopySANs bool

+ Days int

+ type ValidateAIAURLInput struct

+ AllowPrivateNetworks bool

+ URL string

Feb 25, 2026

Changes in this version

+ func FormatDN(name pkix.Name) string

+ func FormatEKUOIDs(raw []byte) []string

+ func FormatEKUs(ekus []x509.ExtKeyUsage) []string

+ func FormatKeyUsage(ku x509.KeyUsage) []string

+ func FormatKeyUsageBitString(raw []byte) []string

+ func ParseOtherNameSANs(extensions []pkix.Extension) []string

Feb 23, 2026

Changes in this version

+ func IsMozillaRoot(cert *x509.Certificate) bool

+ func ValidateAIAURL(rawURL string) error

+ func VerifyChainTrust(input VerifyChainTrustInput) bool

+ type VerifyChainTrustInput struct

+ Cert *x509.Certificate

+ Intermediates *x509.CertPool

+ Roots *x509.CertPool

Feb 16, 2026

Changes in this version

+ func ParseCertificatesAny(data []byte) ([]*x509.Certificate, error)

Feb 15, 2026

Changes in this version

+ func DeduplicatePasswords(extra []string) []string

+ func IsIssuedByMozillaRoot(cert *x509.Certificate) bool

+ func MozillaRootPEM() []byte

+ func MozillaRootPool() (*x509.CertPool, error)

+ func MozillaRootSubjects() map[string]bool

+ func ParseCertificateAny(data []byte) (*x509.Certificate, error)

type BundleOptions

+ ExcludeRoot bool

Feb 11, 2026

Changes in this version

+ func CertAKIEmbedded(cert *x509.Certificate) string

+ func CertSKI(cert *x509.Certificate) string

+ func CertSKIEmbedded(cert *x509.Certificate) string

+ func ComputeSKI(pub crypto.PublicKey) ([]byte, error)

+ func ComputeSKILegacy(pub crypto.PublicKey) ([]byte, error)

Feb 11, 2026

Changes in this version

+ func CertAKIDEmbedded(cert *x509.Certificate) string

+ func CertExpiresWithin(cert *x509.Certificate, d time.Duration) bool

+ func CertFingerprint(cert *x509.Certificate) string

+ func CertFingerprintColonSHA1(cert *x509.Certificate) string

+ func CertFingerprintColonSHA256(cert *x509.Certificate) string

+ func CertFingerprintSHA1(cert *x509.Certificate) string

+ func CertSKID(cert *x509.Certificate) string

+ func CertSKIDEmbedded(cert *x509.Certificate) string

+ func CertToPEM(cert *x509.Certificate) string

+ func ClassifyHosts(hosts []string) (dnsNames []string, ips []net.IP, uris []*url.URL, emails []string)

+ func ColonHex(b []byte) string

+ func ComputeSKID(pub crypto.PublicKey) ([]byte, error)

+ func ComputeSKIDLegacy(pub crypto.PublicKey) ([]byte, error)

+ func DecodeJKS(data []byte, password string) ([]*x509.Certificate, []crypto.PrivateKey, error)

+ func DecodePKCS12(pfxData []byte, password string) (crypto.PrivateKey, *x509.Certificate, []*x509.Certificate, error)

+ func DecodePKCS7(derData []byte) ([]*x509.Certificate, error)

+ func DefaultPasswords() []string

+ func EncodeJKS(privateKey crypto.PrivateKey, leaf *x509.Certificate, ...) ([]byte, error)

+ func EncodePKCS12(privateKey crypto.PrivateKey, leaf *x509.Certificate, ...) ([]byte, error)

+ func EncodePKCS12Legacy(privateKey crypto.PrivateKey, leaf *x509.Certificate, ...) ([]byte, error)

+ func EncodePKCS7(certs []*x509.Certificate) ([]byte, error)

+ func FetchAIACertificates(ctx context.Context, cert *x509.Certificate, timeout time.Duration, ...) ([]*x509.Certificate, []string)

+ func FetchLeafFromURL(ctx context.Context, rawURL string, timeout time.Duration) (*x509.Certificate, error)

+ func GenerateCSR(leaf *x509.Certificate, privateKey crypto.PrivateKey) (csrPEM string, keyPEM string, err error)

+ func GenerateCSRFromCSR(source *x509.CertificateRequest, signer crypto.Signer) (string, error)

+ func GenerateCSRFromTemplate(tmpl *CSRTemplate, signer crypto.Signer) (string, error)

+ func GenerateECKey(curve elliptic.Curve) (*ecdsa.PrivateKey, error)

+ func GenerateEd25519Key() (ed25519.PublicKey, ed25519.PrivateKey, error)

+ func GenerateRSAKey(bits int) (*rsa.PrivateKey, error)

+ func GetCertificateType(cert *x509.Certificate) string

+ func GetPublicKey(priv crypto.PrivateKey) (crypto.PublicKey, error)

+ func IsPEM(data []byte) bool

+ func KeyAlgorithmName(key crypto.PrivateKey) string

+ func KeyMatchesCert(priv crypto.PrivateKey, cert *x509.Certificate) (bool, error)

+ func MarshalPrivateKeyToPEM(key crypto.PrivateKey) (string, error)

+ func MarshalPublicKeyToPEM(pub crypto.PublicKey) (string, error)

+ func ParsePEMCertificate(pemData []byte) (*x509.Certificate, error)

+ func ParsePEMCertificateRequest(pemData []byte) (*x509.CertificateRequest, error)

+ func ParsePEMCertificates(pemData []byte) ([]*x509.Certificate, error)

+ func ParsePEMPrivateKey(pemData []byte) (crypto.PrivateKey, error)

+ func ParsePEMPrivateKeyWithPasswords(pemData []byte, passwords []string) (crypto.PrivateKey, error)

+ func PublicKeyAlgorithmName(key crypto.PublicKey) string

+ func VerifyCSR(csr *x509.CertificateRequest) error

+ type BundleOptions struct

+ AIAMaxDepth int

+ AIATimeout time.Duration

+ CustomRoots []*x509.Certificate

+ ExtraIntermediates []*x509.Certificate

+ FetchAIA bool

+ IncludeRoot bool

+ TrustStore string

+ Verify bool

+ func DefaultOptions() BundleOptions

+ type BundleResult struct

+ Intermediates []*x509.Certificate

+ Leaf *x509.Certificate

+ Roots []*x509.Certificate

+ Warnings []string

+ func Bundle(ctx context.Context, leaf *x509.Certificate, opts BundleOptions) (*BundleResult, error)

+ type CSRSubject struct

+ CommonName string

+ Country []string

+ Locality []string

+ Organization []string

+ OrganizationalUnit []string

+ Province []string

+ type CSRTemplate struct

+ Hosts []string

+ Subject CSRSubject

+ func ParseCSRTemplate(data []byte) (*CSRTemplate, error)