cert

cert inspects remote and local TLS material, verifies trust and host names, checks certificate/key pairs, creates keys and CSRs, signs certificates and converts PEM, DER and PKCS#12.

SecurityVersion 1.2.4Stable
lil-terminal

Overview

Use cert for both diagnosis and certificate preparation without relying on system OpenSSL commands. Remote verification is enabled by default; -k is a diagnostic exception, while generated private keys are written with restrictive permissions.

Identity, trust and key matching are separate checks

A certificate can be within its validity period yet fail trust or host-name verification, and a valid certificate may still not match a private key. Use -v for trust/host checks, -m for the key pair, and -h -chain when you need to inspect what a remote server actually presents.

Syntax

lil-terminal
cert <operation> [args] [options]

Reference

cert -h me [port]

inspect the current host TLS certificate

cert -h <host|url> [port]

inspect a remote TLS certificate

cert -i <file> [-p <pass>]

inspect a local certificate, request, key or PKCS#12 bundle

cert -v <cert> [-ca <file>] [-chain <file>] [-host <name>] [-client]

verify time, trust and hostname

cert -m <cert> <key> [-p <pass>]

verify that a certificate and private key match

cert -key <out> [-rsa <bits>|-ec <curve>] [-p <pass>] [-f]

create a private key

cert -csr <key> <out> <dn> [-san <list>] [-p <pass>] [-f]

create a certificate signing request

cert -self <key> <out> <dn> [-san <list>] [-p <pass>] [-f]

create a self-signed certificate

cert -sign <csr> <ca> <key> <out> [-san <list>] [-p <pass>] [-f]

sign a request with a CA certificate

cert -der <cert> [out] [-f]

convert a PEM certificate to DER

cert -pem <cert> [out] [-f]

convert a DER certificate to PEM

cert -p12 <cert> <key> [out] [-p <pass>] [-kp <pass>] [-f]

create a PKCS#12 bundle

cert -p12 -r <bundle> [dir] [-p <pass>] [-f]

extract a PKCS#12 bundle

-j | -json

show -h, -i, -v or -m results as JSON

-t [seconds]

use 5 seconds or a timeout from 1 to 300 for remote TLS

-T

use a 300-second timeout for remote TLS

-4 | -6

use IPv4 or IPv6 for remote TLS

-k

allow an unverified remote TLS certificate

-chain

show the complete remote certificate chain

-sni <name>

override the TLS SNI name

-ca <file>

use an explicit CA file where supported

-host <name>

verify a certificate for one hostname

-client

verify for TLS client use

-p <pass>

provide an operation password

-f

allow replacement for generated files

Target shortcut

me resolves to the current HTTP host visible to PHP. Use it when you want to inspect the certificate of the site that is serving this terminal without retyping its hostname.

Safety

Remote certificates are verified by default. Private-key files are written with restrictive permissions. Use -k only to distinguish trust problems from basic TLS reachability, and avoid putting passwords directly into command history when a hidden prompt is available.

JSON output

Use -j or -json with -h, -i, -v or -m when another command or API workflow needs machine-readable certificate diagnostics.

Interactive sandbox preview

Run the prepared examples directly on the page. Their results are prebuilt and shown in the browser; no terminal command is executed on the server.

Inspect a remote TLS certificate

Install and manage

Install the current compatible version. Choose Base for the complete feature set or Minimum for the reduced package; use upgrade to update a module that is already installed.

Base and Minimum are two packages of the same current module release, not separate command versions.

Base package

Install the complete package with local command reference and every published mode.

install cert
Minimum package

Install the reduced package. Local reference is omitted; help <cmd> -i opens the current server reference.

install cert -m
Exact public version

Install exactly this published version.

install cert -v 1.2.4
Check or update

Ask upgrade to check compatibility and replace the installed block only when needed.

upgrade cert
Remove module

Remove the extension block while leaving the core and unrelated modules intact.

install cert -u

Examples

Examples are copyable command lines, not actions executed by this website. Review paths, permissions and destructive flags before running them on a real project.

Inspect a remote TLS certificate
cert -h me
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test -t 5
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test -T
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test -4
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test -6
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         2001:db8::80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test -chain
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Chain      2 certificates
Inspect a remote TLS certificate
cert -h example.test -sni www.example.test
Offline training example — no live HTTP, mail or TLS request
Host       example.test
SNI        www.example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (www.example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test -k
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     unverified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Inspect a remote TLS certificate
cert -h example.test -j
Offline training example — no live HTTP, mail or TLS request
{
    "rows": [
        {
            "name": "Host",
            "value": "example.test"
        },
        {
            "name": "IP",
            "value": "192.0.2.80"
        },
        {
            "name": "Port",
            "value": "443"
        },
        {
            "name": "Status",
            "value": "verified"
        },
        {
            "name": "Time",
            "value": "14.8 ms"
        },
        {
            "name": "TLS",
            "value": "TLSv1.3"
        },
        {
            "name": "Cipher",
            "value": "TLS_AES_256_GCM_SHA384"
        },
        {
            "name": "Hostname",
            "value": "valid (example.test)"
        },
        {
            "name": "Subject",
            "value": "CN=example.test"
        },
        {
            "name": "Issuer",
            "value": "CN=Training CA"
        },
        {
            "name": "Valid to",
            "value": "2027-10-31 00:00:00 UTC"
        }
    ]
}
Inspect a remote TLS certificate
cert -h example.test -o tmp/chain.pem
Offline training example — no live HTTP, mail or TLS request
Host       example.test
IP         192.0.2.80
Port       443
Status     verified
Time       14.8 ms
TLS        TLSv1.3
Cipher     TLS_AES_256_GCM_SHA384
Hostname   valid (example.test)
Subject    CN=example.test
Issuer     CN=Training CA
Valid to   2027-10-31 00:00:00 UTC
Saved      sandbox/tmp/chain.pem
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i certs/server.crt
Offline training example — no live HTTP, mail or TLS request
File              sandbox/certs/server.crt
Certificates      1

Certificate 1:    
Subject           CN=example.test, O=lil
Issuer            CN=example.test, O=lil
Serial            01FAB2F36D62878EE1C3EF872CC4924ADAE7FACD
Valid from        2026-08-09 08:38:07 UTC
Valid to          2036-08-06 08:38:07 UTC
Validity          valid, 3566 days remaining
SAN               DNS:example.test, DNS:www.example.test
Key               RSA
Key bits          2048
Signature         RSA-SHA256
SHA256            FE:BE:96:6B:FD:A6:EA:E5:98:E1:66:7E:A3:32:72:7D:E3:DE:37:CC:D8:2F:64:63:76:73:26:C6:4B:F5:7D:CD
Constraints       CA:FALSE
Key usage         Digital Signature, Key Encipherment
Extended usage    TLS Web Server Authentication
Subject key ID    D6:14:0F:93:56:90:A8:E6:CC:3D:8C:D5:16:AE:EB:05:0C:07:8B:1D
Authority key ID  D6:14:0F:93:56:90:A8:E6:CC:3D:8C:D5:16:AE:EB:05:0C:07:8B:1D
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i certs/server.csr
Offline training example — no live HTTP, mail or TLS request
File      sandbox/certs/server.csr
Type      CSR
Subject   CN=example.test, O=lil
Key       RSA
Key bits  2048
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i certs/server.key
Offline training example — no live HTTP, mail or TLS request
File      sandbox/certs/server.key
Type      private key
Key       RSA
Key bits  2048
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i certs/server.p12 -p demo
Offline training example — no live HTTP, mail or TLS request
File            sandbox/certs/server.p12
Type            PKCS#12
Certificates    1
Private key     yes

Certificate 1:  
Subject         CN=example.test, O=lil
Issuer          CN=example.test, O=lil
Serial          01FAB2F36D62878EE1C3EF872CC4924ADAE7FACD
Valid from      2026-08-09 08:38:07 UTC
Valid to        2036-08-06 08:38:07 UTC
Validity        valid, 3566 days remaining
SAN             DNS:example.test, DNS:www.example.test
Key             RSA
Key bits        2048
Signature       RSA-SHA256
SHA256          FE:BE:96:6B:FD:A6:EA:E5:98:E1:66:7E:A3:32:72:7D:E3:DE:37:CC:D8:2F:64:63:76:73:26:C6:4B:F5:7D:CD
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i certs/server.crt -json
Offline training example — no live HTTP, mail or TLS request
{
    "rows": [
        {
            "name": "File",
            "value": "sandbox/certs/server.crt"
        },
        {
            "name": "Certificates",
            "value": "1"
        },
        {
            "name": "Certificate 1:",
            "value": ""
        },
        {
            "name": "Subject",
            "value": "CN=example.test, O=lil"
        },
        {
            "name": "Issuer",
            "value": "CN=example.test, O=lil"
        },
        {
            "name": "Serial",
            "value": "01FAB2F36D62878EE1C3EF872CC4924ADAE7FACD"
        },
        {
            "name": "Valid from",
            "value": "2026-08-09 08:38:07 UTC"
        },
        {
            "name": "Valid to",
            "value": "2036-08-06 08:38:07 UTC"
        },
        {
            "name": "Validity",
            "value": "valid, 3566 days remaining"
        },
        {
            "name": "SAN",
            "value": "DNS:example.test, DNS:www.example.test"
        },
        {
            "name": "Key",
            "value": "RSA"
        },
        {
            "name": "Key bits",
            "value": "2048"
        },
        {
            "name": "Signature",
            "value": "RSA-SHA256"
        },
        {
            "name": "SHA256",
            "value": "FE:BE:96:6B:FD:A6:EA:E5:98:E1:66:7E:A3:32:72:7D:E3:DE:37:CC:D8:2F:64:63:76:73:26:C6:4B:F5:7D:CD"
        },
        {
            "name": "Constraints",
            "value": "CA:FALSE"
        },
        {
            "name": "Key usage",
            "value": "Digital Signature, Key Encipherment"
        },
        {
            "name": "Extended usage",
            "value": "TLS Web Server Authentication"
        },
        {
            "name": "Subject key ID",
            "value": "D6:14:0F:93:56:90:A8:E6:CC:3D:8C:D5:16:AE:EB:05:0C:07:8B:1D"
        },
        {
            "name": "Authority key ID",
            "value": "D6:14:0F:93:56:90:A8:E6:CC:3D:8C:D5:16:AE:EB:05:0C:07:8B:1D"
        }
    ]
}
Verify time, trust and hostname
cert -v certs/server.crt -host example.test
Offline training example — no live HTTP, mail or TLS request
File      sandbox/certs/server.crt
Purpose   TLS server
Time      valid
Trust     invalid
Hostname  valid (example.test)
Result    invalid
Verify time, trust and hostname
cert -v certs/server.crt -ca certs/server.crt
Offline training example — no live HTTP, mail or TLS request
File     sandbox/certs/server.crt
Purpose  TLS server
Time     valid
Trust    valid
Result   valid
Verify time, trust and hostname
cert -v certs/server.crt -client
Offline training example — no live HTTP, mail or TLS request
File     sandbox/certs/server.crt
Purpose  TLS client
Time     valid
Trust    invalid
Result   invalid
Verify that a certificate and private key match
cert -m certs/server.crt certs/server.key
Offline training example — no live HTTP, mail or TLS request
Certificate  sandbox/certs/server.crt
Private key  sandbox/certs/server.key
Result       match
Verify that a certificate and private key match
cert -m certs/server.crt certs/server.key -j
Offline training example — no live HTTP, mail or TLS request
{
    "rows": [
        {
            "name": "Certificate",
            "value": "sandbox/certs/server.crt"
        },
        {
            "name": "Private key",
            "value": "sandbox/certs/server.key"
        },
        {
            "name": "Result",
            "value": "match"
        }
    ]
}
Create a private key
cert -key tmp/demo.key -rsa 2048
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo.key
draft.txt
new.txt
Create a private key
cert -key tmp/demo-ec.key -ec prime256v1
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo-ec.key
draft.txt
new.txt
Create a certificate signing request
cert -csr certs/server.key tmp/demo.csr "CN=example.test" -san DNS:example.test
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo.csr
draft.txt
new.txt
Create a self-signed certificate
cert -self certs/server.key tmp/demo.crt "CN=example.test" -san DNS:example.test
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo.crt
draft.txt
new.txt
Convert a PEM certificate to DER
cert -der certs/server.crt tmp/demo.der
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo.der
draft.txt
new.txt
Convert a DER certificate to PEM
cert -pem certs/server.der tmp/demo.pem
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo.pem
draft.txt
new.txt
Create a PKCS#12 bundle
cert -p12 certs/server.crt certs/server.key tmp/demo.p12
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo.p12
draft.txt
new.txt
Cert · demo
cert -p12 -r certs/server.p12 tmp/unpacked -p demo
Offline training example — no live HTTP, mail or TLS request
server.cert.pem
server.key.pem
Sign a request with a CA certificate
cert -sign certs/server.csr certs/server.crt certs/server.key tmp/signed.crt
Offline training example — no live HTTP, mail or TLS request
CA certificate is not allowed to sign certificates
Verify time, trust and hostname
cert -v certs/server.crt -chain certs/server.crt
Offline training example — no live HTTP, mail or TLS request
File     sandbox/certs/server.crt
Purpose  TLS server
Time     valid
Trust    invalid
Result   invalid
Inspect a remote TLS certificate
cert -h example.test -4 -6
Offline training example — no live HTTP, mail or TLS request
Choose either IPv4 or IPv6
Inspect a remote TLS certificate
cert -h example.test -t 301
Offline training example — no live HTTP, mail or TLS request
Invalid timeout
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i certs/missing.pem
Offline training example — no live HTTP, mail or TLS request
File not found
Verify time, trust and hostname
cert -v certs/missing.pem
Offline training example — no live HTTP, mail or TLS request
Certificate not found
Verify that a certificate and private key match
cert -m certs/server.crt certs/missing.key
Offline training example — no live HTTP, mail or TLS request
Private key not found
Create a private key
cert -key tmp/demo.key -rsa 1024
Offline training example — no live HTTP, mail or TLS request
RSA bits must be 2048–16384 in steps of 256
Inspect a remote TLS certificate
cert -h example.test -sni
Offline training example — no live HTTP, mail or TLS request
SNI name required
Create a private key
cert -key tmp/demo.key -ec unknown
Offline training example — no live HTTP, mail or TLS request
Use prime256v1, secp384r1, or secp521r1
Create a private key
cert -key tmp/demo.key -f -rsa 2048
Offline training example — no live HTTP, mail or TLS request
README.txt
current.txt
demo.key
draft.txt
new.txt
Create a self-signed certificate
cert -self certs/missing.key tmp/missing.crt "CN=example.test"
Offline training example — no live HTTP, mail or TLS request
Private key not found
Inspect a remote TLS certificate
cert -h example.test -ca missing-ca.pem
Offline training example — no live HTTP, mail or TLS request
CA file not found
Cert · -unknown
cert -unknown
Offline training example — no live HTTP, mail or TLS request
Unknown cert operation
Inspect a local certificate, request, key or PKCS#12 bundle
cert -i certs/server.crt -j -json
Offline training example — no live HTTP, mail or TLS request
{
    "rows": [
        {
            "name": "File",
            "value": "sandbox/certs/server.crt"
        },
        {
            "name": "Certificates",
            "value": "1"
        },
        {
            "name": "Certificate 1:",
            "value": ""
        },
        {
            "name": "Subject",
            "value": "CN=example.test, O=lil"
        },
        {
            "name": "Issuer",
            "value": "CN=example.test, O=lil"
        },
        {
            "name": "Serial",
            "value": "01FAB2F36D62878EE1C3EF872CC4924ADAE7FACD"
        },
        {
            "name": "Valid from",
            "value": "2026-08-09 08:38:07 UTC"
        },
        {
            "name": "Valid to",
            "value": "2036-08-06 08:38:07 UTC"
        },
        {
            "name": "Validity",
            "value": "valid, 3566 days remaining"
        },
        {
            "name": "SAN",
            "value": "DNS:example.test, DNS:www.example.test"
        },
        {
            "name": "Key",
            "value": "RSA"
        },
        {
            "name": "Key bits",
            "value": "2048"
        },
        {
            "name": "Signature",
            "value": "RSA-SHA256"
        },
        {
            "name": "SHA256",
            "value": "FE:BE:96:6B:FD:A6:EA:E5:98:E1:66:7E:A3:32:72:7D:E3:DE:37:CC:D8:2F:64:63:76:73:26:C6:4B:F5:7D:CD"
        },
        {
            "name": "Constraints",
            "value": "CA:FALSE"
        },
        {
            "name": "Key usage",
            "value": "Digital Signature, Key Encipherment"
        },
        {
            "name": "Extended usage",
            "value": "TLS Web Server Authentication"
        },
        {
            "name": "Subject key ID",
            "value": "D6:14:0F:93:56:90:A8:E6:CC:3D:8C:D5:16:AE:EB:05:0C:07:8B:1D"
        },
        {
            "name": "Authority key ID",
            "value": "D6:14:0F:93:56:90:A8:E6:CC:3D:8C:D5:16:AE:EB:05:0C:07:8B:1D"
        }
    ]
}

Related documentation

Is lil-terminal safe to leave on a production site? →How does authorization work? →

Current public release

v1.2.42026-08-09

Language synchronization

Finalizes Local and Server Help synchronization and localization safety for cert.

# Version history