JokerSoft — PKI & Certificate Intelligence
JokerSoft — PKI & Certificate Intelligence
JokerSoft — PKI & Certificate Intelligence
📋 Exemples — chkcert_V1R1M1
📋 Examples — chkcert_V1R1M1
📋 Ejemplos — chkcert_V1R1M1
Capture dynamique — Généré : 2026-08-01 · Binaire compilé Nuitka (autonome, sans interpréteur Python)
Dynamic capture — Generated: 2026-08-01 · Nuitka-compiled binary (standalone, no Python interpreter needed)
Captura dinámica — Generado: 2026-08-01 · Binario compilado con Nuitka (autónomo, sin intérprete Python)
Avec une licence Team/Pro/Enterprise — la section
--remote ci-dessous est affichée en entier.With a Team/Pro/Enterprise licence — the --remote section below is shown in full.Con una licencia Team/Pro/Enterprise — la sección --remote de abajo se muestra completa.EXAMPLES Sortie dynamique (verbatim, non traduite)Dynamic output (verbatim, not translated)Salida dinámica (verbatim, sin traducir)
# --------------------------------------------------------------------------------
# ./chkcert.exe --examples
chkcert.exe - Certificate Information/Control Tool Version: V1R1M1
# --------------------------------------------------------------------------------
General options:
chkcert.exe --help
chkcert.exe --version
chkcert.exe --examples
#--------------------------------------------------------------------------------
# Single file (--file):
chkcert.exe --file certificate/jk_sub_on_ch.ch.cer
chkcert.exe --file certificate/root_jk_group .cer
chkcert.exe --file certificate/new_file/test01_20250825_admknt.cer
chkcert.exe --file certificate/new_file/test02_20250825_admknt.csr
chkcert.exe --file certificate/new_file/test03_20250825_admknt.jks
chkcert.exe --file certificate/keyrepos/PHAQMGRJOK01/PHAQMGRJOK01.p12
chkcert.exe --file certificate/keyrepos/PHAQMGRJOK01/PHAQMGRJOK01.pfx
chkcert.exe --file certificate/keyrepos/XJKQMGRNSL04/shaqmgrnsl01_B64.p7b
chkcert.exe --file certificate/ref_keystore/JK_JOK_External_ch.pbk.jks # --password changeit by default
chkcert.exe --file certificate/ref_keystore/JK_JOK_Internal_ch.pbk.jks # --password changeit by default
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed # stashed password
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --password changeit # explicit password
chkcert.exe --file keyrepos/XJKQMGRNSL04/key.kdb --stashed --chaining alias
chkcert.exe --file keyrepos/XJKQMGRNSL04/key.kdb --stashed --chaining serial
chkcert.exe --file keyrepos/XJKQMGRNSL04/key.kdb --stashed --chaining both
chkcert.exe --file certificate/ref_keystore/JK_JOK_External_ch.pbk.jks --password changeit
#--------------------------------------------------------------------------------
# Directory scan (--dir, recursive):
chkcert.exe --dir certificate/
chkcert.exe --dir certificate/p7b/
chkcert.exe --dir certificate/keyrepos/PHAQMGRJOK01/
chkcert.exe --dir keyrepos/PHAQMGRJOK01/ --stashed
chkcert.exe --dir certificate/ --password changeit
chkcert.exe --dir keyrepos/PHAQMGRJOK01/ # kdb with stashed password
chkcert.exe --dir keyrepos/ --stashed # all kdb in directory
chkcert.exe --dir keyrepos/ --stashed --chaining both
#--------------------------------------------------------------------------------
# Chaining summary options (--chaining alias|serial|both):
chkcert.exe --file certificate/jk_sub_on_ch.cer --chaining alias # default
chkcert.exe --file certificate/jk_sub_on_ch.cer --chaining serial
chkcert.exe --file certificate/jk_sub_on_ch.cer --chaining both
chkcert.exe --dir certificate/ --chaining serial
chkcert.exe --dir certificate/ --chaining BOTH # case-insensitive
#--------------------------------------------------------------------------------
# Extension filter (--ext EXT [EXT ...]):
chkcert.exe --dir certificate/ --ext cer pem # only .cer and .pem
chkcert.exe --dir certificate/ --ext certificate # alias: cer cert crt pem arm der
chkcert.exe --dir keyrepos/ --ext keystore # alias: p12 pfx pkcs12 kdb p7b jks jck jceks
chkcert.exe --dir requests/ --ext request # alias: csr
chkcert.exe --dir mixed/ --ext keystore request # keystore + csr
chkcert.exe --dir mixed/ --ext certificate request # certificate + csr
chkcert.exe --dir mixed/ --ext keystore csr pem # alias + individual extensions
chkcert.exe --dir mixed/ --ext p12 pfx kdb # multiple individual extensions
chkcert.exe --file mixed/* --ext keystore # unquoted glob (shell-expanded) + ext filter
chkcert.exe --file 'mixed/*' --ext keystore # quoted glob (chkcert's own glob) + ext filter
chkcert.exe --file a.kdb b.p12 c.crl --ext keystore # explicit multi-file list + ext filter
--------------------------------------------------------------------------------
# Multiple files via --file (explicit list or unquoted glob):
chkcert.exe --file certs/a.kdb certs/b.kdb certs/c.p12 # explicit space-separated list
chkcert.exe --file keyrepos/*.kdb # unquoted — the SHELL expands it before chkcert runs
chkcert.exe --file keyrepos/*.kdb --ext keystore # recommended: add --ext to filter out unrelated matches
chkcert.exe --file 'keyrepos/*.kdb' # quoted — chkcert's own internal glob handles it instead
chkcert.exe --file 'certs/**/*.pem' # quoted recursive glob (** ) — must be quoted, the shell can't expand it
#--------------------------------------------------------------------------------
# Java cacerts truststore (--cacerts [FILE]):
chkcert.exe --cacerts # auto-detect from active JDK (java.home / JAVA_HOME / PATH)
chkcert.exe --cacerts --alias digicert # auto-detect + filter on alias/CN/subject/issuer
chkcert.exe --cacerts --output html # auto-detect + export to HTML
chkcert.exe --cacerts --output both --quiet # auto-detect + json + html, no console
chkcert.exe --cacerts --report # auto-detect + remediation report
chkcert.exe --cacerts --chaining both # auto-detect + chaining summary
chkcert.exe --cacerts jks/digicert_truststore.jks # explicit path: any JKS truststore
chkcert.exe --cacerts jks/sectigo_truststore.jks --password changeit # explicit path + password
chkcert.exe --cacerts jks/globalsign_truststore.jks --alias globalsign # explicit path + alias filter
chkcert.exe --cacerts jks/entrust_truststore.jks --output html # explicit path + HTML export
chkcert.exe --cacerts jks/verisign_truststore.jks --output both --quiet # explicit path + json + html, no console
chkcert.exe --cacerts 'C:/Program Files/OpenJDK/jdk-25.0.3+9/lib/security/cacerts' # Windows OpenJDK explicit path
#--------------------------------------------------------------------------------
# Alias filter (--alias PATTERN):
chkcert.exe --file -cacerts --alias sectigo # legacy: filter on alias/CN/subject/issuer
chkcert.exe --cacerts $JAVA_HOME/lib/security/cacerts --alias sectigo # preferred: --cacerts + --alias
chkcert.exe --cacerts jks/digicert_truststore.jks --alias 'digicert' # case-insensitive
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --alias eqm # grep on alias
chkcert.exe --dir keyrepos/ --stashed --alias stelink --chaining serial
chkcert.exe --cacerts jks/globalsign_truststore.jks --alias globalsign --chaining both
#--------------------------------------------------------------------------------
# Output format (--output json|html|both):
chkcert.exe --file certificate/jk_sub_on_ch.cer --output json # export to .json file
chkcert.exe --file certificate/jk_sub_on_ch.cer --output html # export to .html report
chkcert.exe --file certificate/jk_sub_on_ch.cer --output both # export to .json + .html
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --output json
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --output html
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --output both
chkcert.exe --dir keyrepos/ --stashed --output json # one .json per file
chkcert.exe --dir keyrepos/ --stashed --output html # one .html per file
chkcert.exe --dir keyrepos/ --stashed --output both # one .json + .html per file
chkcert.exe --file key.kdb --stashed --alias eqm --chaining both --output both # combine all options
#--------------------------------------------------------------------------------
# Remediation report (--report):
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --report
chkcert.exe --dir keyrepos/ --stashed --report # global report across all files
chkcert.exe --dir keyrepos/ --stashed --report --output html # report + html export
chkcert.exe --dir keyrepos/ --stashed --report --output json # report + json export
#--------------------------------------------------------------------------------
# Quiet mode (--quiet) and no-color (--no-color):
chkcert.exe --file key.kdb --stashed --output html --quiet # html only, no console output
chkcert.exe --dir keyrepos/ --stashed --output json --quiet # json only, no console output
chkcert.exe --file key.kdb --stashed --quiet # no --output given: --quiet alone defaults to --output html (OUTPUT_FORMAT_DFT); without --quiet, no --output means no file at all
chkcert.exe --file key.kdb --stashed --no-color # no ANSI codes (log-friendly)
chkcert.exe --file keyrepos/PHAQMGRJOK01/key.kdb --stashed --report --cmd # show renewal cmds for .kdb
chkcert.exe --dir keyrepos/ --stashed --report --cmd --output html # full report with cmds
chkcert.exe --file certificate/SJOKQMGRNSL02.p12 --password changeit --report --cmd # show keytool cmds for .p12
#--------------------------------------------------------------------------------
# Reference date (--date):
chkcert.exe --file key.kdb --stashed --date 2026-12-31 # fixed date
chkcert.exe --file key.kdb --stashed --date +180 # today + 180 days
chkcert.exe --file key.kdb --stashed --date -30 # today - 30 days
chkcert.exe --dir keyrepos/ --stashed --date +90 # expiry check in 90 days
#--------------------------------------------------------------------------------
Remote execution (--remote, requires: pip install paramiko):
chkcert.exe --remote PMQCVM1099 --remote-user mqm --remote-key ~/.ssh/id_rsa --file /var/mqm/ssl/key.kdb --stashed --output html
chkcert.exe --remote PMQCVM1099 --remote-user mqm --remote-key ~/.ssh/id_rsa --file /var/mqm/ssl/key.kdb --stashed --report --cmd
chkcert.exe --remote srv-win01 --remote-user admin --remote-pass rmt-password --file C:/MQ/ssl/key.kdb --stashed --output json
chkcert.exe --remote aix-srv01 --remote-user mqm --remote-key ~/.ssh/id_ed25519 --file /var/mqm/ssl/key.kdb --stashed --output html --report
# Windows ---> Linux : --remote-key recommended
# Windows ---> Windows : OpenSSH must be enabled on target (Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0)
# Linux ---> Unix/AIX: --remote-key recommended, check python path on target