Repolode
Submit
Hakky54

Hakky54/certificate-ripper

A CLI tool that extracts TLS/SSL certificates from servers and exports them as PEM, DER, or truststores.

View on GitHub
Stars
937
Forks
80
Open issues
0
Last commit
22 days ago

What is it?

Certificate Ripper, invoked as the `crip` command, connects to a server and extracts its certificate chain without requiring openssl. It can print certificates in a human-readable form or in PEM format, and can export them as PEM, DER, PKCS12 (p12) or JKS truststores. Multiple URLs can be processed in one command, and certificates can be filtered by type (root, intermediate, leaf).

Beyond HTTPS, it supports WebSocket Secure (wss), FTPS, SMTPS, IMAPS, and PostgreSQL and MySQL database connections, as well as the operating system's trusted certificates. Proxy settings are available for environments where traffic must pass through a proxy.

The tool is distributed as a native executable built with GraalVM or as a fat jar that runs on Java 21. It is also available through Homebrew, apt, Chocolatey, Scoop, AUR and NixOS, and it can be used as a Java library through its DSL.

Key features

  • 01Extracts server certificate chains over HTTPS, WSS, FTPS, SMTPS, IMAPS, PostgreSQL and MySQL.
  • 02Exports certificates as PEM, DER, PKCS12 or JKS truststores.
  • 03Processes multiple URLs in a single command.
  • 04Filters certificates by root, intermediate or leaf type.
  • 05Works behind a proxy without requiring openssl.

Use cases

  • Adding a corporate or self-signed server certificate to a Java truststore.
  • Inspecting the certificate chain of a site during TLS troubleshooting.
  • Collecting PEM certificates for configuring clients or services.
  • Exporting certificates for integration tests of TLS connections.

Quick start

  1. 1

    Install via Homebrew (macOS/Linux)

    brew install crip
  2. 2

    Print the certificates of a server

    crip print -u=https://github.com
  3. 3

    Export certificates as a PKCS12 truststore

    crip export pkcs12 -u=https://github.com

Things to know

  • Java 21 is required to run the fat jar, and GraalVM 24 is needed to build the native executable.

Topics

#certificate#tls#ssl#x509#cli#java#graalvm#security-tools#graal-native#graalvm-native-image

FAQ

What is certificate-ripper?
A CLI tool that extracts TLS/SSL certificates from servers and exports them as PEM, DER, or truststores. Certificate Ripper, invoked as the `crip` command, connects to a server and extracts its certificate chain without requiring openssl. It can print certificates in a human-readable form or in PEM format, and can export them as PEM, DER, PKCS12 (p12) or JKS truststores. Multiple URLs can be processed in one command, and certificates can be filtered by type (root, intermediate, leaf).
Is certificate-ripper free to use? What license does it have?
certificate-ripper is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is certificate-ripper still maintained?
Actively maintained. The last commit to certificate-ripper was on Sep 28, 2026.
What can I use certificate-ripper for?
Adding a corporate or self-signed server certificate to a Java truststore. Inspecting the certificate chain of a site during TLS troubleshooting. Collecting PEM certificates for configuring clients or services. Exporting certificates for integration tests of TLS connections.
How do I install certificate-ripper?
Install via Homebrew (macOS/Linux): brew install crip Print the certificates of a server: crip print -u=https://github.com Export certificates as a PKCS12 truststore: crip export pkcs12 -u=https://github.com
Where can I get certificate-ripper?
The source code and installation instructions are on GitHub: https://github.com/Hakky54/certificate-ripper

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects