JokerSoft — PKI & Certificate Intelligence
JokerSoft — PKI & Certificate Intelligence
JokerSoft — PKI & Certificate Intelligence
📋 Exemples — checkcert_V1R1M1
📋 Examples — checkcert_V1R1M1
📋 Ejemplos — checkcert_V1R1M1
Capture dynamique — Généré : 2026-08-01 · Binaire compilé Nuitka (autonome, sans interpréteur Python)
Dynamic capture — Generated: 2026-08-01 · Nuitka-compiled binary (standalone, no Python interpreter needed)
Captura dinámica — Generado: 2026-08-01 · Binario compilado con Nuitka (autónomo, sin intérprete Python)
Avec une licence Team/Pro/Enterprise — la section
--remote ci-dessous est affichée en entier.With a Team/Pro/Enterprise licence — the --remote section below is shown in full.Con una licencia Team/Pro/Enterprise — la sección --remote de abajo se muestra completa.EXAMPLES Sortie dynamique (verbatim, non traduite)Dynamic output (verbatim, not translated)Salida dinámica (verbatim, sin traducir)
# ./checkcert.exe --examples
checkcert.exe - Certificate Information/Control Tool Version: V1R1M1
# ln -s Linux_AlmaLinux_10.2_checkcert.exe checkcert.exe
# --------------------------------------------------------------------------------
General options:
./checkcert.exe --help
./checkcert.exe --version
./checkcert.exe --examples
#--------------------------------------------------------------------------------
# Single file (--file):
./checkcert.exe --file certificate/jk_sub_on_ch.ch.cer
./checkcert.exe --file certificate/root_jk_group .cer
./checkcert.exe --file certificate/new_file/test01_20250825_admknt.cer
./checkcert.exe --file certificate/new_file/test02_20250825_admknt.csr
./checkcert.exe --file certificate/new_file/test03_20250825_admknt.jks
./checkcert.exe --file certificate/keyrepos/PHAQMGRJOK01/PHAQMGRJOK01.p12
./checkcert.exe --file certificate/keyrepos/PHAQMGRJOK01/PHAQMGRJOK01.pfx
./checkcert.exe --file certificate/keyrepos/XJKQMGRNSL04/shaqmgrnsl01_B64.p7b
./checkcert.exe --file certificate/ref_keystore/JK_JOK_External_ch.pbk.jks # --password changeit by default
./checkcert.exe --file certificate/ref_keystore/JK_JOK_Internal_ch.pbk.jks # --password changeit by default
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed # stashed password
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --password changeit # explicit password
./checkcert.exe --file keyrepos/XJKQMGRNSL04/key.kdb --stashed --chaining alias
./checkcert.exe --file keyrepos/XJKQMGRNSL04/key.kdb --stashed --chaining serial
./checkcert.exe --file keyrepos/XJKQMGRNSL04/key.kdb --stashed --chaining both
./checkcert.exe --file certificate/ref_keystore/JK_JOK_External_ch.pbk.jks --password changeit
#--------------------------------------------------------------------------------
# Directory scan (--dir, recursive):
./checkcert.exe --dir certificate/
./checkcert.exe --dir certificate/p7b/
./checkcert.exe --dir certificate/keyrepos/PHAQMGRJOK01/
./checkcert.exe --dir keyrepos/PHAQMGRJOK01/ --stashed
./checkcert.exe --dir certificate/ --password changeit
./checkcert.exe --dir keyrepos/PHAQMGRJOK01/ # kdb with stashed password
./checkcert.exe --dir keyrepos/ --stashed # all kdb in directory
./checkcert.exe --dir keyrepos/ --stashed --chaining both
#--------------------------------------------------------------------------------
# Chaining summary options (--chaining alias|serial|both):
./checkcert.exe --file certificate/jk_sub_on_ch.cer --chaining alias # default
./checkcert.exe --file certificate/jk_sub_on_ch.cer --chaining serial
./checkcert.exe --file certificate/jk_sub_on_ch.cer --chaining both
./checkcert.exe --dir certificate/ --chaining serial
./checkcert.exe --dir certificate/ --chaining BOTH # case-insensitive
#--------------------------------------------------------------------------------
# Extension filter (--ext EXT [EXT ...]):
./checkcert.exe --dir certificate/ --ext cer pem # only .cer and .pem
./checkcert.exe --dir certificate/ --ext certificate # alias: cer cert crt pem arm der
./checkcert.exe --dir keyrepos/ --ext keystore # alias: p12 pfx pkcs12 kdb p7b jks jck jceks
./checkcert.exe --dir requests/ --ext request # alias: csr
./checkcert.exe --dir mixed/ --ext keystore request # keystore + csr
./checkcert.exe --dir mixed/ --ext certificate request # certificate + csr
./checkcert.exe --dir mixed/ --ext keystore csr pem # alias + individual extensions
./checkcert.exe --dir mixed/ --ext p12 pfx kdb # multiple individual extensions
./checkcert.exe --file mixed/* --ext keystore # unquoted glob (shell-expanded) + ext filter
./checkcert.exe --file 'mixed/*' --ext keystore # quoted glob (checkcert's own glob) + ext filter
./checkcert.exe --file a.kdb b.p12 c.crl --ext keystore # explicit multi-file list + ext filter
--------------------------------------------------------------------------------
# Multiple files via --file (explicit list or unquoted glob):
./checkcert.exe --file certs/a.kdb certs/b.kdb certs/c.p12 # explicit space-separated list
./checkcert.exe --file keyrepos/*.kdb # unquoted — the SHELL expands it before checkcert runs
./checkcert.exe --file keyrepos/*.kdb --ext keystore # recommended: add --ext to filter out unrelated matches
./checkcert.exe --file 'keyrepos/*.kdb' # quoted — checkcert's own internal glob handles it instead
./checkcert.exe --file 'certs/**/*.pem' # quoted recursive glob (** ) — must be quoted, the shell can't expand it
#--------------------------------------------------------------------------------
# Java cacerts truststore (--cacerts [FILE]):
./checkcert.exe --cacerts # auto-detect from active JDK (java.home / JAVA_HOME / PATH)
./checkcert.exe --cacerts --alias digicert # auto-detect + filter on alias/CN/subject/issuer
./checkcert.exe --cacerts --output html # auto-detect + export to HTML
./checkcert.exe --cacerts --output both --quiet # auto-detect + json + html, no console
./checkcert.exe --cacerts --report # auto-detect + remediation report
./checkcert.exe --cacerts --chaining both # auto-detect + chaining summary
./checkcert.exe --cacerts jks/digicert_truststore.jks # explicit path: any JKS truststore
./checkcert.exe --cacerts jks/sectigo_truststore.jks --password changeit # explicit path + password
./checkcert.exe --cacerts jks/globalsign_truststore.jks --alias globalsign # explicit path + alias filter
./checkcert.exe --cacerts jks/entrust_truststore.jks --output html # explicit path + HTML export
./checkcert.exe --cacerts jks/verisign_truststore.jks --output both --quiet # explicit path + json + html, no console
./checkcert.exe --cacerts 'C:/Program Files/OpenJDK/jdk-25.0.3+9/lib/security/cacerts' # Windows OpenJDK explicit path
#--------------------------------------------------------------------------------
# Alias filter (--alias PATTERN):
./checkcert.exe --file -cacerts --alias sectigo # legacy: filter on alias/CN/subject/issuer
./checkcert.exe --cacerts $JAVA_HOME/lib/security/cacerts --alias sectigo # preferred: --cacerts + --alias
./checkcert.exe --cacerts jks/digicert_truststore.jks --alias 'digicert' # case-insensitive
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --alias eqm # grep on alias
./checkcert.exe --dir keyrepos/ --stashed --alias stelink --chaining serial
./checkcert.exe --cacerts jks/globalsign_truststore.jks --alias globalsign --chaining both
#--------------------------------------------------------------------------------
# Output format (--output json|html|both):
./checkcert.exe --file certificate/jk_sub_on_ch.cer --output json # export to .json file
./checkcert.exe --file certificate/jk_sub_on_ch.cer --output html # export to .html report
./checkcert.exe --file certificate/jk_sub_on_ch.cer --output both # export to .json + .html
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --output json
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --output html
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --output both
./checkcert.exe --dir keyrepos/ --stashed --output json # one .json per file
./checkcert.exe --dir keyrepos/ --stashed --output html # one .html per file
./checkcert.exe --dir keyrepos/ --stashed --output both # one .json + .html per file
./checkcert.exe --file key.kdb --stashed --alias eqm --chaining both --output both # combine all options
#--------------------------------------------------------------------------------
# Remediation report (--report):
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --report
./checkcert.exe --dir keyrepos/ --stashed --report # global report across all files
./checkcert.exe --dir keyrepos/ --stashed --report --output html # report + html export
./checkcert.exe --dir keyrepos/ --stashed --report --output json # report + json export
#--------------------------------------------------------------------------------
# Quiet mode (--quiet) and no-color (--no-color):
./checkcert.exe --file key.kdb --stashed --output html --quiet # html only, no console output
./checkcert.exe --dir keyrepos/ --stashed --output json --quiet # json only, no console output
./checkcert.exe --file key.kdb --stashed --quiet # no --output given: --quiet alone defaults to --output html (OUTPUT_FORMAT_DFT); without --quiet, no --output means no file at all
./checkcert.exe --file key.kdb --stashed --no-color # no ANSI codes (log-friendly)
./checkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --report --cmd # show renewal cmds for .kdb
./checkcert.exe --dir keyrepos/ --stashed --report --cmd --output html # full report with cmds
./checkcert.exe --file certificate/SJOKQMGRNSL02.p12 --password changeit --report --cmd # show keytool cmds for .p12
#--------------------------------------------------------------------------------
# Reference date (--date):
./checkcert.exe --file key.kdb --stashed --date 2026-12-31 # fixed date
./checkcert.exe --file key.kdb --stashed --date +180 # today + 180 days
./checkcert.exe --file key.kdb --stashed --date -30 # today - 30 days
./checkcert.exe --dir keyrepos/ --stashed --date +90 # expiry check in 90 days
#--------------------------------------------------------------------------------
Remote execution (--remote, requires: pip install paramiko):
./checkcert.exe --remote PMQCVM1099 --remote-user mqm --remote-key ~/.ssh/id_rsa --file /var/mqm/ssl/key.kdb --stashed --output html
./checkcert.exe --remote PMQCVM1099 --remote-user mqm --remote-key ~/.ssh/id_rsa --file /var/mqm/ssl/key.kdb --stashed --report --cmd
./checkcert.exe --remote srv-win01 --remote-user admin --remote-pass rmt-password --file C:/MQ/ssl/key.kdb --stashed --output json
./checkcert.exe --remote aix-srv01 --remote-user mqm --remote-key ~/.ssh/id_ed25519 --file /var/mqm/ssl/key.kdb --stashed --output html --report
# Windows ---> Linux : --remote-key recommended
# Windows ---> Windows : OpenSSH must be enabled on target (Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0)
# Linux ---> Unix/AIX: --remote-key recommended, check python path on target