# Check SSL domain
ssl-tools check google.com

# Decode certificate
ssl-tools decode-cert certificate.crt

# Build fullchain.pem
ssl-tools bundle certificate.crt --bundle ca_bundle.crt --key commercial.key

# Build Tomcat keystore
ssl-tools tomcat certificate.crt --key commercial.key --bundle ca_bundle.crt

# Remove passphrase from private key
ssl-tools key commercial.key --decrypt --passphrase your_passphrase

# JSON output for scripting
ssl-tools check example.com --json | jq '.validTo'

Command Reference

SSL Checker

Check live SSL certificate status and details for a domain.

$ssl-tools check example.com

$ssl-tools check example.com --port 8443

$ssl-tools check example.com --json

CSR Decoder

Decode a Certificate Signing Request from a .csr file.

$ssl-tools decode-csr request.csr

$ssl-tools decode-csr request.csr --json

CSR Creator

Create a CSR with a generated private key or an uploaded private key.

$ssl-tools create-csr --cn example.com --san example.com --san www.example.com

$ssl-tools create-csr --cn example.com --key-algorithm rsa-4096 --encrypt-key --passphrase secret

$ssl-tools create-csr --cn example.com --key private.key --csr-output request.csr

Certificate Decoder

Parse an X.509 certificate (PEM or DER).

$ssl-tools decode-cert certificate.crt

$ssl-tools decode-cert certificate.der --json

Key Matcher

Verify whether a private key matches a certificate.

$ssl-tools match certificate.crt private.key

$ssl-tools match certificate.crt private.key --json

SSL Converter

Convert certificate formats: PEM ↔ DER ↔ PFX, and read P7B.

$ssl-tools convert cert.pem --to der

$ssl-tools convert cert.pem --to pfx --key private.key --passphrase secret

$ssl-tools convert bundle.pfx --to pem --passphrase secret

$ssl-tools convert chain.p7b --to pem

Build PEM Bundle

Combine key + cert + CA chain into fullchain.pem (order: key → cert → intermediate → rootca).

$ssl-tools bundle certificate.crt --bundle ca_bundle.crt

$ssl-tools bundle certificate.crt --intermediate int.crt --rootca root.crt

$ssl-tools bundle certificate.crt --bundle ca_bundle.crt --key commercial.key

$ssl-tools bundle certificate.crt --bundle ca_bundle.crt -o /etc/nginx/ssl/fullchain.pem

Tomcat Keystore

Build a PKCS#12 keystore with the full chain — ready for Tomcat 8.5+.

$ssl-tools tomcat certificate.crt --key commercial.key --bundle ca_bundle.crt

$ssl-tools tomcat certificate.crt --key commercial.key --bundle ca_bundle.crt --passphrase changeit

$ssl-tools tomcat certificate.crt --key commercial.key --intermediate int.crt --rootca root.crt

Private Key Convert

Remove the passphrase from an encrypted key, or add one to an unencrypted key.

$ssl-tools key commercial.key --decrypt --passphrase current_pass

$ssl-tools key private.key --encrypt --passphrase new_pass

$ssl-tools key commercial.key --decrypt --passphrase current_pass -o plain.key

Output JSON

All commands support the --json flag for machine-readable output:

$ ssl-tools check google.com --json | jq .
{
  "domain": "google.com",
  "status": "valid",
  "daysRemaining": 68,
  "issuer": "WR2",
  "validFrom": "2025-04-14",
  "validTo": "2025-07-07",
  "protocol": "TLSv1.3",
  "sans": ["*.google.com", "google.com"]
}

Open Source

Source code is available on GitHub. Contributions, issues, and PRs are always welcome.

View on GitHub →