JokerSoft — PKI & Certificate Intelligence
JokerSoft — PKI & Certificate Intelligence
JokerSoft — PKI & Certificate Intelligence
📋 Aide — chkcert_V1R1M1
📋 Help — chkcert_V1R1M1
📋 Ayuda — chkcert_V1R1M1
Capture dynamique — Généré : 2026-08-01 · Binaire compilé Nuitka (autonome, sans interpréteur Python)
Dynamic capture — Generated: 2026-08-01 · Nuitka-compiled binary (standalone, no Python interpreter needed)
Captura dinámica — Generado: 2026-08-01 · Binario compilado con Nuitka (autónomo, sin intérprete Python)
Avec une licence Team/Pro/Enterprise — la section
--remote ci-dessous est affichée en entier.With a Team/Pro/Enterprise licence — the --remote section below is shown in full.Con una licencia Team/Pro/Enterprise — la sección --remote de abajo se muestra completa.HELP Sortie dynamique (verbatim, non traduite)Dynamic output (verbatim, not translated)Salida dinámica (verbatim, sin traducir)
# ./chkcert.exe --help
chkcert.exe - Certificate Information/Control Tool Version: V1R1M1
# ln -s Linux_AlmaLinux_10.2_chkcert.exe chkcert.exe
usage: chkcert.exe [-h] [--version] [--examples] [--file FILE [FILE ...] | --dir DIR] [--password PASSWORD | --stashed] [--chaining MODE] [--alias PATTERN] [--cacerts [FILE]] [--ext EXT [EXT ...]]
[--output FORMAT] [--report] [--cmd] [--remote HOST] [--remote-port PORT] [--remote-user USER] [--remote-key KEYFILE] [--remote-pass PASSWORD]
[--remote-timeout SECONDS] [--trust-new-host] [--no-color] [--quiet] [--date DATE]
options:
-h, --help Show this help message and exit
--version Show version information
--examples Show usage examples
--file FILE [FILE ...]
Path(s) to certificate file(s) to process. Supports wildcards: *.kdb, ca_*.cer, **/*.pem (recursive) — quote the pattern so chkcert's own glob logic handles it: --file
'certs/*.cer'. If left unquoted, the SHELL expands the wildcard itself into several filenames before chkcert even runs — --file also accepts multiple space-separated paths directly
for that case, so both work. Examples: --file key.kdb | --file 'certs/*.cer' | --file a.kdb b.kdb c.kdb
--dir DIR Path to a directory — all recognized certificate files are processed recursively (including subdirectories)
--password PASSWORD Password for encrypted certificate file
--stashed Use stashed password instead of providing one
--report Print a prioritised remediation report at the end of the analysis. P1=CRITICAL (blocking), P2=WARNING (to plan), P3=INFO (to verify). With --dir, the report is global across all
files scanned.
--chaining MODE Chaining summary display mode: alias (default), serial, both
--output FORMAT Export analysis results to a file: json (machine-readable), html (browser report), or both (json + html). Output filename is derived from the input filename with the appropriate
extension. With --quiet and no --output, defaults to html (overridable via OUTPUT_FORMAT_DFT in constantes_V1R1M1.properties). --output json | --output html | --output both
--cmd In the remediation report (--report), append the keytool or runmqakm CSR renewal command matching the certificate's original DN attributes. Requires --report to be active.
--quiet Suppress all console output. Only JSON/HTML files are produced. Useful when --output json or --output html is active and console output is not needed. Errors and warnings are still
written to the output files.
--alias PATTERN Filter: only display certificates whose alias, CN, subject or issuer contains PATTERN (case-insensitive). Chaining summary shows all certificates linked to the matches.
--cacerts [FILE] Analyse the Java cacerts truststore. Without a value: auto-detects cacerts from the active JDK (java.home property, JAVA_HOME env, or PATH). With a value: path to any JKS truststore
regardless of filename. Default password: 'changeit' (override with --password). Examples: --cacerts (auto-detect from JDK) --cacerts jks/digicert_truststore.jks (explicit path)
--cacerts C:/jdk-25/lib/security/cacerts (explicit JDK cacerts)
--ext EXT [EXT ...] Filter files by extension (--dir, or --file with a wildcard pattern or multiple values — ignored when --file is a single literal filename with no wildcard). Accepts individual
extensions (p12 pfx pkcs12 kdb p7b jks jck jceks) and/or aliases: 'keystore' (p12 pfx pkcs12 kdb p7b jks jck jceks) or 'certificate' (cer cert crt pem arm der) or 'request' (csr).
Multiple values allowed: --ext keystore csr pem
--no-color Disable all ANSI colour output (useful for terminals that do not support colours, or when redirecting output to a file).
--date DATE Override the reference date used for expiry calculations. Accepts: YYYY-MM-DD (fixed date) or +N / -N (days offset from today). Examples: --date 2026-12-31 | --date +180 | --date -30
Remote execution (requires paramiko on Python):
--remote HOST Hostname or IP of the remote server. The file is fetched via SFTP, analysed locally, outputs (JSON/HTML) are saved locally.
--remote-port PORT SSH port on the remote server (default: 22)
--remote-user USER SSH username for the remote server
--remote-key KEYFILE Path to the SSH private key file (recommended). Example: ~/.ssh/id_rsa or C:\Users\admin\.ssh\id_rsa
--remote-pass PASSWORD
SSH password for the remote server. Using --remote-key is strongly recommended instead.
--remote-timeout SECONDS
SSH connection timeout in seconds (default: 30). Increase for slow or distant servers.
--trust-new-host Accept and cache an unknown SSH host key on the first connection. Use only for first-time connections to a new server. Subsequent runs will use the cached key from known_hosts.