cert

cert inspects remote and local TLS material, verifies trust and host names, checks certificate/key pairs, creates keys and CSRs, signs certificates and converts PEM, DER and PKCS#12.

SecurityVersion 1.2.4Stable
lil-terminal

Overview

Use cert for both diagnosis and certificate preparation without relying on system OpenSSL commands. Remote verification is enabled by default; -k is a diagnostic exception, while generated private keys are written with restrictive permissions.

Identity, trust and key matching are separate checks

A certificate can be within its validity period yet fail trust or host-name verification, and a valid certificate may still not match a private key. Use -v for trust/host checks, -m for the key pair, and -h -chain when you need to inspect what a remote server actually presents.

Syntax

lil-terminal
cert <operation> [args] [options]

Reference

cert -h me [port]

inspect the current host TLS certificate

cert -h <host|url> [port]

inspect a remote TLS certificate

cert -i <file> [-p <pass>]

inspect a local certificate, request, key or PKCS#12 bundle

cert -v <cert> [-ca <file>] [-chain <file>] [-host <name>] [-client]

verify time, trust and hostname

cert -m <cert> <key> [-p <pass>]

verify that a certificate and private key match

cert -key <out> [-rsa <bits>|-ec <curve>] [-p <pass>] [-f]

create a private key

cert -csr <key> <out> <dn> [-san <list>] [-p <pass>] [-f]

create a certificate signing request

cert -self <key> <out> <dn> [-san <list>] [-p <pass>] [-f]

create a self-signed certificate

cert -sign <csr> <ca> <key> <out> [-san <list>] [-p <pass>] [-f]

sign a request with a CA certificate

cert -der <cert> [out] [-f]

convert a PEM certificate to DER

cert -pem <cert> [out] [-f]

convert a DER certificate to PEM

cert -p12 <cert> <key> [out] [-p <pass>] [-kp <pass>] [-f]

create a PKCS#12 bundle

cert -p12 -r <bundle> [dir] [-p <pass>] [-f]

extract a PKCS#12 bundle

-j | -json

show -h, -i, -v or -m results as JSON

-t [seconds]

use 5 seconds or a timeout from 1 to 300 for remote TLS

-T

use a 300-second timeout for remote TLS

-4 | -6

use IPv4 or IPv6 for remote TLS

-k

allow an unverified remote TLS certificate

-chain

show the complete remote certificate chain

-sni <name>

override the TLS SNI name

-ca <file>

use an explicit CA file where supported

-host <name>

verify a certificate for one hostname

-client

verify for TLS client use

-p <pass>

provide an operation password

-f

allow replacement for generated files

Target shortcut

me resolves to the current HTTP host visible to PHP. Use it when you want to inspect the certificate of the site that is serving this terminal without retyping its hostname.

Safety

Remote certificates are verified by default. Private-key files are written with restrictive permissions. Use -k only to distinguish trust problems from basic TLS reachability, and avoid putting passwords directly into command history when a hidden prompt is available.

JSON output

Use -j or -json with -h, -i, -v or -m when another command or API workflow needs machine-readable certificate diagnostics.

Interactive sandbox preview

Run the prepared examples directly on the page. Their results are prebuilt and shown in the browser; no terminal command is executed on the server.

Inspect a remote TLS certificate

Install and manage

Install the current compatible version. Choose Base for the complete feature set or Minimum for the reduced package; use upgrade to update a module that is already installed.

Base and Minimum are two packages of the same current module release, not separate command versions.

Base package

Install the complete package with local command reference and every published mode.

install cert
Minimum package

Install the reduced package. Local reference is omitted; help <cmd> -i opens the current server reference.

install cert -m
Exact public version

Install exactly this published version.

install cert -v 1.2.4
Check or update

Ask upgrade to check compatibility and replace the installed block only when needed.

upgrade cert
Remove module

Remove the extension block while leaving the core and unrelated modules intact.

install cert -u

Examples

Examples are copyable command lines, not actions executed by this website. Review paths, permissions and destructive flags before running them on a real project.

Inspect a remote TLS certificate
pwd | cert -h example.com -chain
sandbox

Host        example.com
IP          93.184.216.34
Port        443
TLS         TLSv1.3
Subject     CN=example.com
Issuer      Example CA
Chain       3 certificates
Inspect a remote TLS certificate
cert -h me
Host        lil.dog
Port        443
TLS         TLSv1.3
Subject     CN=lil.dog
Issuer      Let's Encrypt
Valid from  2026-07-15 00:00:00 UTC
Valid to    2026-10-13 23:59:59 UTC
Days left   66
Use IPv4 or IPv6 for remote TLS
cert -h example.com -4
Host        example.com
IP          93.184.216.34
Family      IPv4
Port        443
TLS         TLSv1.3
Subject     CN=example.com
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i sandbox/certs/server.crt
File          sandbox/certs/server.crt
Certificates  1

Certificate 1
Subject       CN=example.test, O=lil
Issuer        CN=example.test, O=lil
Valid from    2026-08-09 08:38:07 UTC
Valid to      2036-08-06 08:38:07 UTC
SAN           DNS:example.test, DNS:www.example.test
Key           RSA
Key bits      2048
Verify time, trust and hostname
cert -v sandbox/certs/server.crt -ca sandbox/certs/server.crt -host example.test
File      sandbox/certs/server.crt
Purpose   TLS server
Time      valid
Trust     valid
Hostname  valid (example.test)
Result    valid
Verify that a certificate and private key match
cert -m sandbox/certs/server.crt sandbox/certs/server.key
Certificate  sandbox/certs/server.crt
Private key  sandbox/certs/server.key
Result       match
Cert · create
cert -key sandbox/tmp/site.key -rsa 2048 | cert -self sandbox/tmp/site.key sandbox/tmp/site.crt "CN=example.test,O=lil" -san "DNS:example.test,IP:127.0.0.1"
sandbox/tmp/
  site.key

sandbox/tmp/
  site.crt
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i sandbox/missing.crt
File          sandbox/certs/server.crt
Certificates  1

Certificate 1
Subject       CN=example.test, O=lil
Issuer        CN=example.test, O=lil
Valid from    2026-08-09 08:38:07 UTC
Valid to      2036-08-06 08:38:07 UTC
SAN           DNS:example.test, DNS:www.example.test
Key           RSA
Key bits      2048

Related documentation

Is lil-terminal safe to leave on a production site? →How does authorization work? →

Current public release

v1.2.42026-08-09

Language synchronization

Finalizes Local and Server Help synchronization and localization safety for cert.

# Version history