# certigo: examine and validate certificates from the command line > certigo is a Go utility that reads certificates out of DER, PEM, JCEKS, PKCS7 and PKCS12 files, prints them in a human-readable, PEM or JSON form, connects to remote servers to validate their chains, and speaks StartTLS for MySQL, PostgreSQL, SMTP, LDAP, IMAP and FTP. It suits an engineer debugging a TLS handshake, and the JSON output is what makes it scriptable. **square/certigo** — A utility to examine and validate certificates in a variety of formats - Repository: https://github.com/square/certigo - Stars: 1,037 · Forks: 77 - Language: Go - License: Apache-2.0 - Published: 2026-10-19 · Updated: 2026-10-19 · Language: en - Canonical page: https://hysenlabs.com/projects/square-certigo ## What certigo is for Certigo is a utility to examine and validate certificates to help with debugging SSL/TLS issues. The install is a Go install, and on macOS there is also a Homebrew formula: ```bash go install github.com/square/certigo@latest ``` ```bash brew install certigo ``` The first feature is format coverage. It supports all common file formats, reading and dumping certificates from X.509 in DER or PEM, JCEKS, PKCS7 and PKCS12, and it can automatically detect the format when you do not specify it. The second feature is validation and linting, so if you are not sure whether your generated certificate is valid, certigo can connect to remote servers to display and validate their certificate chains, and it can point out common errors on certificates, such as using an older X.509 format, signatures with outdated hashes, or keys that are too small. The primary language is Go, the licence is Apache-2.0, the last push was on 2026-10-14, and the releases are v1.18.1 on 2026-09-28, v1.18.0 on 2026-04-10 and v1.17.1 on 2025-08-08. The linting side of the tool is the part that is not just a certificate printer. ## The three commands Certigo has three commands, and the split is the mental model. `dump` displays information about a certificate from a file or standard input, with a `-f, --format` flag for the input format, PEM, DER, JCEKS or PKCS12, heuristically detected if missing, a `-p, --password` for PKCS12 and JCEKS stores, `-m, --pem` to write PEM blocks instead of the human-readable format, `-j, --json` for machine-readable output, and `-l, --first` to display only the first certificate. `connect` connects to a server and prints its certificates, with `--name` to override the name used for SNI, `--ca` for a CA bundle with the system default if unspecified, `--cert` and `--key` for a client certificate chain, `--start-tls` for the protocol, `--proxy` for an HTTP CONNECT proxy, and `--verify` to verify the chain. `verify` verifies a certificate chain from a file or standard input against a name. Every command accepts `--json`, and that is the feature that makes it a tool rather than a viewer. ## StartTLS, which is the reason to use this over openssl The third feature is support for StartTLS protocols, and the README frames the problem it solves. Trying to debug SSL/TLS connections on a database or mail server, certigo supports establishing connections via StartTLS for MySQL, PostgreSQL, SMTP, LDAP, IMAP and FTP, making it possible to debug connection issues or scan for expired certificates more easily. This is the practical gap. An SMTP server or a PostgreSQL instance that negotiates TLS on an existing plaintext port is not reachable with a plain HTTPS client, and the openssl s_client route needs a different invocation per protocol. The `--start-tls` flag takes the protocol name, and the `--identity` flag sets the database user or the SMTP EHLO name, which matters because servers check the identity they are told against the certificate. The `--timeout` flag defaults to 5s and accepts durations like 5m or 1s. ## Scripting with JSON, and the jq pairing The scripting support is what the README spends a paragraph on. All commands in certigo have support for optional JSON output, which can be used in shell scripts to analyze or filter output, and the suggested combination is with jq to find all certificates in a bundle that are signed with SHA1-RSA, or to filter for CA certificates, or whatever you need. The `--first` flag is worth noting in that context, since it can be paired with `--json` or `--pem` to narrow the output before filtering, which matters when a bundle contains hundreds of certificates. The example in the README shows the human-readable dump, with the serial number, the validity window, the signature algorithm, the subject and issuer details down to the business category and the EV registration number, the key usage and extended key usage extensions, and the alternate DNS names, which is the level of detail you get without asking for PEM. ## The dependencies, and what they tell you about the internals The go.mod shows a tool built on serious libraries rather than a hand-rolled parser. The linting comes from `zmap/zlint/v3`, which is the same linter set the Certificate Transparency community uses, and `zmap/zcrypto` provides the low-level X.509 handling. `google/certificate-transparency-go` gives the CT awareness. The keystore work is `software.sslmate.com/src/go-pkcs12` for PKCS12, and the `jceks/` and `pkcs7/` directories in the tree are the Java keystore and PKCS7 implementations, with `zmap/zcrypto` covering the ASN.1 side. The StartTLS support pulls in `go-ldap/ldap/v3` for LDAP, and the CLI is built on `alecthomas/kingpin/v2` with `fatih/color` and `mattn/go-colorable` for the terminal output, `mattn/go-isatty` for detecting a terminal, and `Masterminds/sprig/v3` for template functions. The module requires Go 1.26.0. ## Where certigo stops The boundary is between examining and managing. Certigo reads certificates, validates chains and points at problems such as an old X.509 format, an outdated hash or a key that is too small, but it does not issue, renew or revoke anything, and it does not manage a CA. The linting is also worth understanding as a feature with a scope, since it is a linter that applies a rule set and reports, and the rules come from a third party, so a certificate can pass certigo's checks and still be wrong for your deployment. The other limit is the password handling. The `-p, --password` flag takes the keystore password and reads from the terminal if it is missing, which is the right default for an interactive session and the wrong one for a script, so an unattended run has to pass the password explicitly. The `verify` command takes a name to check the certificate against, and the `connect` command defaults `--expected-name` to the name from SNI, or to the hostname being connected to when SNI is not overridden. ## Conclusion Adopt certigo if you need to read a certificate out of a keystore, check a server's chain, or lint a certificate you generated, since it covers the formats and StartTLS protocols that openssl alone makes awkward. Skip it if you need to manage certificates, since it examines rather than issues them. Before you script against it, use the `--json` flag on every command, and note that keystore passwords are read from the terminal when not supplied, which matters when the command runs unattended. ## FAQ ### Which file formats can certigo read? X.509 in DER and PEM, JCEKS, PKCS7 and PKCS12, with automatic detection when the format is not specified. Certificates can be dumped as a human-readable format, as a set of PEM blocks, or as a JSON object for scripting. ### What does certigo check for when linting a certificate? Common errors such as using an older X.509 format, signatures with outdated hashes, or keys that are too small. It can also connect to remote servers to display and validate their certificate chains. ### Which StartTLS protocols does certigo support? MySQL, PostgreSQL, SMTP, LDAP, IMAP and FTP, selected with the --start-tls flag. The --identity flag sets the database user or the SMTP EHLO name, and the --timeout flag defaults to 5s and accepts durations such as 5m or 1s. ### How do I install certigo? With `go install github.com/square/certigo@latest`, which needs Go 1.12 or later to build, or on macOS with `brew install certigo`. The module itself requires Go 1.26.0. ## Sources - [Issues](https://github.com/square/certigo/issues) - [License: Apache-2.0](https://github.com/square/certigo/blob/master/LICENSE) - [README](https://github.com/square/certigo/blob/master/README.md) - [Releases](https://github.com/square/certigo/releases) - [square/certigo on GitHub](https://github.com/square/certigo) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/square-certigo