letstool/http2cert repository overview

⁠http2cert

Lightweight HTTP gateway that inspects X.509 certificates through a JSON REST API. Send a POST /api/v1/certinfo request with a hostname or raw certificate bytes, get the full parsed certificate chain back as structured JSON — equivalent to openssl x509 -noout -text.

Supports live TLS socket inspection (dial by hostname, IPv4, or IPv6) and raw PEM/DER parsing (single certificate or full chain). Returns fingerprints (SHA-1, SHA-256, SHA-512), validity status, Subject/Issuer DN, public key details, and all X.509 v3 extensions.

The binary embeds a web UI (dark/light mode) and an OpenAPI 3.1 spec — no external files, no runtime dependencies.

⁠Quick start

docker run -p 8080:8080 letstool/http2cert:latest

Open http://localhost:8080⁠ to use the web UI, or query the API directly:

curl -s -X POST http://localhost:8080/api/v1/certinfo \
  -H "Content-Type: application/json" \
  -d '{"socket": "example.com:443"}' | jq

To inspect a raw PEM certificate:

curl -s -X POST http://localhost:8080/api/v1/certinfo \
  -H "Content-Type: application/json" \
  -d "{\"raw_cert_data\": \"$(cat cert.pem)\"}" | jq

⁠Configuration

CLI flags take priority over environment variables.

docker run -p 9090:9090 \
  -e LISTEN_ADDR=0.0.0.0:9090 \
  -e DIAL_TIMEOUT=30s \
  -e LOG_JSON=true \
  letstool/http2cert:latest

⁠Repo

https://github.com/letstool/http2cert⁠

⁠License

This project is licensed under the Apache License, Version 2.0⁠.

Copyright (c) 2026 letstool.net

⁠See also