- Stars
- 109
- Forks
- 6
- Open issues
- 19
- Last commit
- 4 days ago
What is it?
sslx is a command-line tool for working with X.509 certificates and TLS connections. It covers tasks that usually take several openssl invocations, such as inspecting a certificate, checking the TLS handshake and chain for a host, verifying a chain against a CA bundle, and confirming that a certificate matches its private key. It is built on rustls, so it does not require a system OpenSSL installation.
Beyond inspection, it can grade a host's TLS configuration on an A+ to F scale by checking protocol version, cipher, certificate validity, key type, hostname matching, chain completeness and ALPN. The expiry command checks many hosts at once and returns exit code 1 when a certificate expires within seven days, which suits cron jobs and CI pipelines. It also generates self-signed certificates and CSRs, converts between PEM, DER and PKCS12, and decodes files or JWT tokens.
Every command accepts a --json flag for scripting, and the project publishes shell completions for bash, zsh and fish. Installation is available through cargo, Homebrew or prebuilt binaries.
Key features
- 01Grades a host's TLS setup from A+ to F across protocol, cipher, certificate and chain checks.
- 02Checks certificate expiry for multiple hosts and returns a non-zero exit code when a certificate is near expiry.
- 03Inspects PEM and DER certificates, including multi-certificate bundles.
- 04Generates self-signed certificates and certificate signing requests.
- 05Converts between PEM, DER and PKCS12 and extracts leaf, intermediate and key files from PKCS12.
- 06Decodes files and JWT tokens, and every command supports JSON output.
Use cases
- Checking certificate expiry across a fleet of hosts in a cron job or CI pipeline.
- Debugging a TLS handshake or a broken certificate chain on a server.
- Generating a local self-signed certificate for development.
- Preparing a CSR to submit to a certificate authority.
Quick start
- 1
Install the sslx binary with Cargo
cargo install sslx - 2
Grade the TLS setup of a host
sslx grade github.com - 3
Generate a self-signed certificate for local development
sslx generate --cn localhost --san "*.local,127.0.0.1"
Things to know
- The README's benchmarks cover only macOS M2, so performance on other platforms is unverified.
- The project is young, with 94 stars and no stated stable release.
In collections
Topics
FAQ
- What is sslx?
- A single Rust binary for inspecting, grading, generating and converting certificates and TLS connections, as a simpler alternative to OpenSSL's CLI. sslx is a command-line tool for working with X.509 certificates and TLS connections. It covers tasks that usually take several openssl invocations, such as inspecting a certificate, checking the TLS handshake and chain for a host, verifying a chain against a CA bundle, and confirming that a certificate matches its private key. It is built on rustls, so it does not require a system OpenSSL installation.
- Is sslx free to use? What license does it have?
- sslx is open source under the MIT license. Check the license terms before using it in commercial products.
- Is sslx still maintained?
- Actively maintained. The last commit to sslx was on Oct 21, 2026.
- What can I use sslx for?
- Checking certificate expiry across a fleet of hosts in a cron job or CI pipeline. Debugging a TLS handshake or a broken certificate chain on a server. Generating a local self-signed certificate for development. Preparing a CSR to submit to a certificate authority.
- How do I install sslx?
- Install the sslx binary with Cargo: cargo install sslx Grade the TLS setup of a host: sslx grade github.com Generate a self-signed certificate for local development: sslx generate --cn localhost --san "*.local,127.0.0.1"
- Where can I get sslx?
- The source code and installation instructions are on GitHub: https://github.com/glincker/sslx
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A CLI tool that extracts TLS/SSL certificates from servers and exports them as PEM, DER, or truststores.
Open-source platform for managing secrets, certificates, keys, privileged access, and AI agent credentials in one place.
A single-binary Rust CLI that instantly serves files and directories over HTTP, with optional auth, uploads, and TLS.
A small, portable C library implementing X.509 certificates and the TLS and DTLS protocols, suited to embedded systems.
An interactive, TLS-capable intercepting HTTP proxy with console, command-line and web interfaces for inspecting HTTP/1, HTTP/2 and WebSocket traffic.